AUTHENTICATED 
US. GOVERNMENT 
INFORMATION ^ 


CREATING ONE DHS: STANDARDIZING DEPART- 
MENT OF HOMELAND SECURITY FINANCIAL 
MANAGEMENT 


HEARING 

BEFORE THE 

SUBCOMMITTEE ON I^IANAGEMENT, 
INVESTIGATIONS, AND OVERSIGHT 

OF THE 

COMMITTEE ON HOMELAND SECURITY 
HOUSE OF REPRESENTATDH]S 

ONE HUNDRED ELEVENTH CONGRESS 

FIRST SESSION 


OCTOBER 29, 2009 


Serial No. 111-42 


Printed for the use of the Committee on Homeland Security 



Available via the World Wide Web: http://www.gpo.gov/fdsys/ 


U.S. GOVERNMENT PRINTING OFFICE 
57-850 PDF WASHINGTON : 2011 


For sale by the Superintendent of Documents, U.S. Government Printing Office 
Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; DC area (202) 512-1800 
Fax: (202) 512-2250 Mail: Stop SSOP, Washington, DC 20402-0001 


COMMITTEE ON HOMELAND SECURITY 


Bennie G. Thompson, 


Loretta Sanchez, California 
Jane Harman, California 
Peter A. DeFazio, Oregon 
Eleanor Holmes Norton, District of 
Columbia 

ZoE Lofgren, California 

Sheila Jackson Lee, Texas 

Henry Cuellar, Texas 

Christopher P. Carney, Pennsylvania 

Yvette D. Clarke, New York 

Laura Richardson, California 

Ann KiRKPATRiCK,Arizona 

Ben Ray Lujan, New Mexico 

Bill Pascrell, Jr., New Jersey 

Emmanuel Cleaver, Missouri 

Al Green, Texas 

James A. Himes, Connecticut 

Mary Jo Kilroy, Ohio 

Eric J.J. Massa, New York 

Dina Titus, Nevada 

Vacancy 


Mississippi, Chairman 
Peter T. King, New York 
Lamar Smith, Texas 
Mark E. Souder, Indiana 
Daniel E. Lungren, California 
Mike Rogers, Alabama 
Michael T. McCaul, Texas 
Charles W. Dent, Pennsylvania 
Gus M. Bilirakis, Florida 
Paul C. Broun, Georgia 
Candice S. Miller, Michigan 
Pete Olson, Texas 
Anh “Joseph” Cao, Louisiana 
Steve Austria, Ohio 


1. Lanier Avant, Staff Director 
Rosaline Cohen, Chief Counsel 
Michael Twinchek, Chief Clerk 
Robert O’Conner, Minority Staff Director 


SUBCOMMITTEE ON MANAGEMENT, INVESTIGATIONS, AND OVERSIGHT 

Christopher P. Carney, Pennsylvania, Chairman 
Peter A. DeFazio, Oregon Gus M. Bilirakis, Florida 

Bill Pascrell, Jr., New Jersey Anh “Joseph” Cao, Louisiana 

Al Green, Texas Daniel E. Lungren, California 

Mary Jo Kilroy, Ohio Peter T. King, New York (Ex Officio) 

Bennie G. Thompson, Mississippi (Ex Officio) 

Tamla T. Scott, Staff Director 
Carla Zamudio-Dolan, Clerk 
Michael Russell, Senior Counsel 
Kerry Kinirons, Minority Subcommittee Lead 


(II) 



CONTENTS 


Page 

Statements 

The Honorable Christopher P. Carney, a Representative in Congress From 
the State of Pennsylvania, and Chairman, Subcommittee on Management, 

Investigations, and Oversight 1 

The Honorable Gus M. Bilirakis, a Representative in Congress From the 
State of Florida, and Ranking Member, Subcommittee on Management, 

Investigations, and Oversight 2 

The Honorable Bennie G. Thompson, a Representative in Congress From 
the State of Mississippi, and Chairman, Committee on Homeland Security: 
Prepared Statement 3 

Witnesses 

Mr. James L. Taylor, Deputy Inspector General, Department of Homeland 
Security: 

Oral Statement 4 

Prepared Statement 6 

Ms. Kay L. Daly, Director, Financial Management and Assurance Issues, 
Government Accountability Office: 

Oral Statement 11 

Prepared Statement 13 

Ms. Peggy Sherry, Acting Chief Financial Officer, Department of Homeland 
Security: 

Oral Statement 20 

Prepared Statement 22 


(III) 




CREATING ONE DHS: STANDARDIZING 

DEPARTMENT OF HOMELAND SECURITY 
FINANCIAL MANAGEMENT 


Thursday, October 29, 2009 

U.S. House of Representatives, 

Committee on Homeland Security, 
Subcommittee on Management, Investigations, 

AND Oversight, 
Washington, DC. 

The subcommittee met, pursuant to call, at 10:00 a.m., in Room 
311, Cannon House Office Building, Hon. Christopher P. Carney 
[Chairman of the subcommittee] presiding. 

Present: Representatives Carney, Pascrell, Green, and Bilirakis. 

Mr. Carney [presiding]. The Subcommittee on Management, In- 
vestigation, and Oversight will come to order. The subcommittee is 
meeting today to receive testimony on “Creating One DHS: Stand- 
ardizing Department of Homeland Security Financial Manage- 
ment.” 

Good morning, all. Please let me begin by stating that this sub- 
committee has rules, and everyone is expected to follow those rules. 
One of those rules. Rule 6, Subsection D, Item 1, states that all tes- 
timony will be received no later than 48 hours in advance of a 
hearing. 

It appears that the Department has a hard time complying with 
this rule from time to time. I know we have had a discussion before 
the hearing started, but this will be my last verbal warning to the 
Department. All testimony will be received 48 hours in advance of 
a hearing, or it will not be accepted. 

I would like to thank Mr. Taylor and Ms. Daly for getting their 
testimony in on time and apologize that they needed to sit here 
while I admonished the Department. 

In any event, okay, this hearing is the first in a series of hear- 
ings the Subcommittee on Management, Investigations, and Over- 
sight will conduct regarding the Department of Homeland Secu- 
rity’s intention to create One DHS. 

One DHS in part will be achieved by consolidating various oper- 
ational functions from the legacy agencies into Department-wide 
systems. It has been 6 years since the Department was established. 
It has yet to implement a Department-wide integrated financial 
management system. DHS receives billions of taxpayer dollars 
every year and to date has been unable to account for a majority 
of their appropriated funding the same way that other departments 
and agencies can. 


( 1 ) 
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Today’s hearing will examine the Department’s myriad financial 
management systems, the steps the Department is taking to unify 
its financial operations into one integrated, standardized, auditable 
system, and best practices that will ensure the Department’s ac- 
counting methodologies will meet the existing standards and proto- 
cols. 

eMerge2, the Department’s initial attempt at financial manage- 
ment consolidation, was unsuccessful. Unfortunately, some 3 years 
and millions of dollars after the effort ceased, many of the problems 
experienced as part of eMerge2 are being experienced with the De- 
partment’s current effort, the Transformation and Systems Consoli- 
dation, or TASC program. 

The problems include integrating the Department’s myriad finan- 
cial systems, determining how the Department can construct a sys- 
tem that will result in accurate and timely financial data, and 
ascertaining how that the limited results of eMerge2 fit within the 
Department’s current efforts. 

The Government Accountability Office has suggested steps the 
Department could take to ensure a successful TASC program, as 
well as how TASC RFPs should be crafted in a way that will en- 
sure DHS is satisfied with the financial — excuse me — with a final 
financial system and accounting system. 

The Department has yet to show that it is taking any of these 
recommendations into consideration. Today I hope to hear how the 
Department will ensure that TASC is a success, including a clear 
strategy that describes how it will be implemented and linked to 
existing Department business processes, policies, and legacy sys- 
tems. 

I want to thank the witnesses for their participation and look for- 
ward to their testimony. 

We will now hear from the Ranking Member, the gentleman from 
Florida, Mr. Bilirakis. 

Mr. Bilirakis. Thank you, Mr. Chairman. I appreciate it very 
much. 

I am pleased the subcommittee is meeting to consider the De- 
partment of Homeland Security’s financial management oversight 
and consolidation efforts. The Department of Homeland Security 
currently has 13 separate financial management systems, down 
from 19 it inherited when the Department was created in 2003. 
The separate financial systems result in inconsistent data across 
the Department and in part contribute to the Department’s inabil- 
ity to obtain a clean audit of its financial statement. 

With respect to the TASC program, I am interested in learning 
more about the Department’s concept of operations and migration 
strategy. I would also like to hear about the Department’s plans for 
contract oversight. This estimated cost of the TASC contract is 
$450 million. As with other large procurements at the Department, 
there is the possibility for cost overruns. 

It has also been suggested that this estimate understates the 
total cost of this contract. By the time eMerge2 was canceled, the 
Department had spent $52 million of the more than $250 million 
estimated project cost. While the GAO indicated that ending the 
program was prudent to cut losses, the Department was left with 
little to show after such a large expenditure. 
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It is my hope that the Department will use the lessons learned 
from eMerge2 to ensure that the funding for TASC is spent in the 
most efficient and effective way possible. I will also note that while 
important, a consolidated financial system is not a silver bullet to 
fix the Department’s financial management issues. The Depart- 
ment must have strong internal controls in place and provide over- 
sight over its people and processes to ensure compliance with the 
relevant policies. 

That said, I would like to welcome our witnesses here today. I 
look forward to your insights on all of these issues. 

I want to thank the Chairman. Thank you, and I yield back the 
balance of my time. 

Mr. Carney. I thank you, Mr. Bilirakis. 

Seeing that the Chairman and Ranking Member aren’t here, 
other Members of the subcommittee are reminded that under com- 
mittee rules opening statements may be submitted for the record. 

[The statement of Chairman Thompson follows:] 

Prepared Statement of Chairman Bennie G. Thompson 
October 29, 2009 

The Department of Homeland Security has one of the largest budgets in the Fed- 
eral Government. 

Each year approximately $40 billion in appropriated funds flows in and out of the 
Department. 

Among other things, these funds are used to pay over 200,000 employees, provide 
disaster aid to States and local governments and purchase the equipment used by 
those protecting our borders. 

We owe it to taxpayers to ensure that these funds are appropriately used, fully 
accounted for, and auditable. 

Unfortunately, this is not the case at the Department of Homeland Security. 

Six years into several attempts at integrating its financial management systems, 
and millions of dollars later, the Department is still using thirteen different systems 
that cannot talk to each other, that do not adequately reflect where funds are lo- 
cated and is unable to let the Department of Treasury know, at any given moment, 
how much money is left in the Department of Homeland Security budget. 

Fortunately, the Department knows that the way out of this conundrum is to inte- 
grate its systems. Unfortunately, I am concerned that it may be heading down the 
same path it took when previous attempts to integrate the Department’s financial 
management systems failed. 

There is a saying that goes: “If you keep doing the same thing, you will keep get- 
ting the same result.” 

Yet, once again, the Department is relying on contractors to do the work that 
should be performed by the Government. 

In this instance, the Department intends to allow a contractor to define what the 
Department needs, then design what it will receive, then map out the strategy for 
implementation. 

The fact that the Department released a Request for Proposal before first defining 
its financial management strategy is troublesome, and sounds like putting the cart 
before the horse. 

Past lessons have taught us that over-relying on contractors can lead to lack of 
proper oversight, performance problems, and skyrocketing costs. 

To that end, I would urge the Department, in an effort to reduce costs, to develop 
its own strategy for integrating its financial management systems and to establish 
a more solid road map. 

Moreover, I am greatly concerned with the findings that the GAO will be pre- 
senting us with today. 

Although the Department has received much guidance from the GAO on the steps 
that must be taken to successfully integrate its financial management systems it ap- 
pears as if this advice has fallen by the wayside. 

I look forward to listening to our witnesses’ testimony today regarding what steps 
are being taken to correct existing deficiencies and whether those steps are enough 
to prevent an unacceptable outcome. 
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Mr. Carney. I want to welcome our witnesses. Our first witness 
is Mr. James L. Taylor, who serves as the deputy inspector general 
for the Department of Homeland Security. Mr. Taylor was selected 
as the deputy inspector general in October 2005. He previously 
served as the deputy chief financial officer, CFO, and director for 
financial management at the Department of Commerce. 

Prior to his work at Commerce, Mr. Taylor held the position of 
deputy chief financial officer at the Federal Emergency Manage- 
ment Agency, FEMA, where he was directly responsible for all fi- 
nancial operations, with expenditures of $4 billion to $10 billion an- 
nually. 

Our second witness is Ms. Kay L. Daly. Ms. Daly currently 
serves as the director for financial management and assurance 
issues at the Government Accountability Office. She is responsible 
for financial management systems, improper payments, con- 
tracting, cost analysis, and health care financial management 
issues. 

She led GAO’s report on key cases of financial management sys- 
tem modernization failures that highlighted the need to follow dis- 
cipline processes in software implementation, use effective human 
capital management, and employ other IT management practices. 

Our third and final witness is Ms. Peggy Sherry, the acting chief 
financial officer for the Department of Homeland Security. Ms. 
Sherry joined the Department in 2007 as the director of the Office 
of Financial Management and is responsible for developing Depart- 
ment-wide financial management policy, leading the Department’s 
financial audits and preparing Department-wide financial reports. 

Prior to joining the Department, she served as the deputy chief 
financial officer for the United States Holocaust Memorial Mu- 
seum, where she oversaw the successful conversion to the muse- 
um’s new financial management system and instituted processes to 
obtain several unqualified audit options — excuse me — several un- 
qualified audit opinions on the museum’s financial statements. 

Without objection, the witnesses’ full statements will be inserted 
into the record. I now ask each witness to summarize for 5 minutes 
their statements, beginning with Mr. Taylor. 

STATEMENT OF JAMES L. TAYLOR, DEPUTY INSPECTOR 
GENERAL, DEPARTMENT OF HOMELAND SECURITY 

Mr. Taylor. Thank you, Mr. Chairman. 

Mr. Chairman, Ranking Member Bilirakis, and Members of the 
committee, thank you for the opportunity to appear before you 
today on behalf of the Homeland Security Office of Inspector Gen- 
eral. My testimony today will focus on the financial management 
challenges facing the Department and its components and the 
progress made so far in addressing these challenges. 

Inspectors general are required by law to annually report on the 
top management challenges facing the departments or agencies 
they oversee. For DHS the Office of Inspector General has consist- 
ently placed financial management high on that list. However, fix- 
ing financial management at DHS will require more than just fo- 
cusing on this one area singularly. 

Rather, DHS needs continuous efforts to address its financial 
processes, as well as two related areas identified in our annual 
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management challenges report: Information technology manage- 
ment as well as acquisition management. 

DHS must re-engineer and standardize its underlying financial 
processes so they conform to the requirements of the CFO Act of 
1990. In addition, DHS must strengthen how it manages informa- 
tion technology so it is able to develop and implement integrated 
systems to support redesigned financial processes. 

Finally, DHS must address long-standing deficiencies in acquisi- 
tion management to ensure it can acquire effectively the informa- 
tion technology needed to meet its financial management respon- 
sibilities. 

DHS has worked hard to improve financial management over the 
last 6 years, and the OIG is proud of our relationship with the 
CFO’s office in trying to meet these challenges. However, signifi- 
cant challenges do remain. 

The Department has consistently been unable to obtain an un- 
qualified audit opinion or any audit opinion on its financial state- 
ments. Additionally, the OIG has to issue a separate opinion on in- 
ternal controls. DHS is the only Federal department that is re- 
quired to have a separate audit opinion on internal controls. 

That opinion has also been a disclaimer for the last few years. 
In other words the Department is not yet at a point where any 
opinion can be rendered on either the Department’s financial state- 
ments or its internal controls or financial reporting. 

Obtaining unqualified opinions on financial statements and in- 
ternal controls should not be the end goal. Rather, it should be a 
milestone in providing management and stakeholders with useful, 
timely financial data for decision-making. The annual financial 
statement audit provides insight into the progress the Department 
is making in resolving weaknesses in processes and systems, and 
an essential part of the Department’s efforts to improve financial 
reporting is improving the systems which compile and maintain fi- 
nancial information. 

Since 2003 IT general controls have been evaluated as part of 
DHS’s financial statement audit. This review has included assess- 
ing key core financial systems at FEMA, Customs and Border Pro- 
tection, TSA, Coast Guard, Federal Law Enforcement Training 
Center, U.S. Immigration and Customs Enforcement, and U.S. Citi- 
zenship and Immigration Services. 

Generally, DHS’s IT financial systems are fragmented, do not 
share data effectively, and over the years have developed security 
control weaknesses that undermine the overall reliability. Collec- 
tively, the IT control weaknesses we identified limit DHS’s ability 
to ensure that critical financial and operational data were main- 
tained in such a manner to ensure confidentiality, integrity, and 
availability. 

In addition, these weaknesses negatively impacted the internal 
controls over DHS’s financial reporting and its operation, and we 
consider them to collectively represent material weaknesses. 

DHS has recognized that it needs to improve financial manage- 
ment processes, as well as the systems that support those proc- 
esses. Toward that end, DHS is moving ahead with the TASC sys- 
tem already mentioned, an enterprise-wide initiative aimed at mod- 
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ernizing, transforming, and integrating the financial acquisition 
and asset management capabilities of DHS components. 

TASC is DHS’s third attempt to address comprehensively its 
long-standing financial management process and systems problems. 
The first, known as eMerge, was canceled December 2005 after 
DHS had spent millions on what DHS officials had determined to 
be a failure. The second effort ended after a successful court chal- 
lenge. 

These failures illustrate the critical need for close CFO-CIO co- 
operation properly identifying the requirements for any system and 
the need for sound oversight of the process by trained and experi- 
enced contracts officers and specialists. 

The latest effort is a high-risk initiative that would take years 
to complete. It is now estimated to cost in excess of $1 billion. We 
are presently completing a review of DHS’s efforts in planning and 
implementing TASC and plan to report on the results of our review 
in a few months. 

In summary, Mr. Chairman, the DHS CFO and CIO, in conjunc- 
tion with component CFOs and CIOs, are responsible for working 
together to standardize DHS’s core financial systems. However, 
weaknesses in financial management processes and IT security 
controls over the systems continue to hinder the Department’s abil- 
ity to effectively produce accurate financial information. 

DHS’s ability to significantly improve the quality of its financial 
reporting hinges on the successful implementation of new systems 
and improved business processes in order to promote sound finan- 
cial management. 

Mr. Chairman, this concludes my prepared statement. Thank you 
for the opportunity, and I welcome any questions from you or Mem- 
bers of the subcommittee. 

[The statement of Mr. Taylor follows:] 

Prepared Statement of James L. Taylor 
October 29, 2009 

Mr. Chairman and Members of the committee: Thank you for the opportunity to 
appear before you on behalf of the Department of Homeland Security Office of In- 
spector General. My testimony today will focus on the financial management chal- 
lenges facing the Department and its components, and the progress made so far in 
addressing these challenges. 

Inspectors general are required by law to annually report on the top management 
challenges for the departments or agencies they oversee. For DHS, the Office of In- 
spector General has consistently placed financial management high on that list. 
However, fixing financial management in DHS will require more than just focusing 
on this one area. Rather, DHS needs to continue its efforts to address its financial 
management processes, as well as two related areas identified in our November 
2008 report: Information technology (IT) management and acquisition management. 
Specifically, DHS must reengineer and standardize its underl 3 dng financial proc- 
esses so they conform to the requirements of the Chief Financial Officer Act of 1990. 
In addition, DHS must strengthen how it manages information technology, so it is 
able to develop and implement integrated systems that support redesigned financial 
processes. Finally, DHS must address long-standing inefficiencies in acquisition 
management, to ensure it can acquire effectively the information technology needed 
to meet its financial management responsibilities. 

DHS FINANCIAL MANAGEMENT 

DHS has worked hard to improve financial management, but significant chal- 
lenges remain. The Department consistently has been unable to obtain an unquali- 
fied audit opinion, or any audit opinion, on its financial statements. For fiscal year 
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2008, the independent auditors issued a disclaimer on DHS’ financial statements 
and identified significant deficiencies which were so serious they qualified as mate- 
rial weaknesses. Additionally the OIG issued a disclaimer on DHS’ Internal Control 
Over Financial Reporting (ICOFR). DHS’ ability to obtain an unqualified audit opin- 
ion, and provide assurances that its system of internal control is designed and oper- 
ating effectively, is highly dependent upon business process improvements across 
the Department. 

Aside from being required by the Chief Financial Officer Act of 1990, financial 
statement audits provide insight into the status of financial management and 
progress in resolving weaknesses in processes and systems. For fiscal year 2008, the 
Department was able to reduce the number of conditions leading to the independent 
auditors’ disclaimer of opinion on DHS’ financial statements from six to three. As 
a result, the Office of Financial Management and the Office of Health Affairs no 
longer contribute to the disclaimer conditions and FEMA remediated all its prior 
year disclaimer conditions. However, during the fiscal year 2008 audit, new dis- 
claimer conditions were identified at TSA and FEMA. TSA was unable to assert 
that its capital asset balances were fairly stated and FEMA was unable to assert 
that its capital asset balances were fairly stated, respectively. 

The Departmental material weaknesses in internal control were primarily attrib- 
utable to the Coast Guard, EEMA, and TSA. The Coast Guard’s material weak- 
nesses, which have existed since 1994, i contribute to all six of the Department’s ma- 
terial weaknesses, while FEMA contributed to four and TSA contributed to three. 
The Coast Guard also contributes to TSA’s financial systems security material 
weakness due to TSA’s reliance on the Coast Guard’s financial systems. Although 
the other components did not have material weaknesses, some had significant defi- 
ciencies that, when combined, contributed to the Departmental material weak- 
nesses. 


DHS’ IT FINANCIAL SYSTEMS 

Generally, DHS’ IT financial systems are fragmented, do not share data effec- 
tively, and over the years have developed security control weaknesses that under- 
mine their overall reliability. Fixing these systems and eliminating security 
vulnerabilities will be critical to DHS’ efforts to improve financial management. 

Since 2003, IT general controls have been evaluated as a part of DHS’s financial 
statement audit. This review has included assessing key core financial systems at 
FEMA, Customs and Border Protection (CBP), TSA, Coast Guard, Federal Law En- 
forcement Training Center (FLETC), U.S. Immigration and Customs Enforcement, 
and U.S. Citizenship and Immigration Services. As a part of these reviews, controls 
over applications being processed on various platforms were evaluated, including 
Oracle and SAP. The objective of these audits was to evaluate the effectiveness of 
IT general controls over DHS’ financial processing environment and related IT infra- 
structure as necessary to support the results of the financial statement audit. 

We reported in April 2009 that DHS components have taken significant steps to 
improve financial system security and address prior year IT control weaknesses, 
which resulted in the closure of more than 40% of our prior year IT control find- 
ings.^ Additionally, some DHS components reduced the severity of the weaknesses 
when compared to findings reported in the prior year. However, access controls and 
service continuity continue to be issues at several components including EEMA, 
Coast Guard, and TSA. The most significant weaknesses from a financial statement 
audit perspective include: 

• Excessive unauthorized access to key DHS financial applications; 

• Application change control processes that are inappropriate, not fully defined, 
followed, or effective; and, 

• Service continuity issues impacting DHS’ ability to ensure that DHS financial 
data is available when needed. 

Collectively, the IT control weaknesses we identified limited DHS’ ability to en- 
sure that critical financial and operational data were maintained in such a manner 
to ensure confidentiality, integrity, and availability. In addition, these weaknesses 
negatively impacted the internal controls over DHS’ financial reporting and its oper- 
ation, and we consider them to collectively represent a material weakness. The in- 
formation technology findings were combined into one material weakness regarding 
IT for the fiscal year 2008 audit of the DHS consolidated financial statements. 


^DOT-OIG, Significant Internal Control Weaknesses Identified in Audits of FY 1994 and 1995, 
R3-CG-6-011, August 1996. 

^Information Technology Management Letter for the FY 2008 DHS Financial Statement Audit 
(OIG-09-50, April 2009). 
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We recommended that the DHS Chief Information Officer (CIO), in conjunction 
with the DHS Chief Financial Officer (CFO) and the component CIOs and CFOs 
make improvements in the areas of access controls, application software develop- 
ment and change controls, service continuity, entity-wide security, system software, 
and segregation of duties. 

COMPONENT IT FINANCIAL SYSTEMS 

For fiscal year 2008, we issued separate IT management letter reports for FEMA, 
CBP, TSA, Coast Guard, and FLETC and an overall consolidated IT management 
letter report that summarized the IT issues for all seven components. Each manage- 
ment letter addressed the IT security issues at each component and provided indi- 
vidual component level findings and recommendations. In each of these manage- 
ment letters we recommended that the component CIOs and CFOs in conjunction 
with the DHS CIO and CFO work to address the issues noted in our reports. 

Coast Guard 

We reported in March 2009 that the Coast Guard took corrective action to address 
nearly half of its prior year IT control weaknesses.^ However, we continued to iden- 
tify IT general control weaknesses. The most significant weaknesses from a financial 
statement audit perspective related to the development, implementation, and track- 
ing of financial systems coding changes, and the design and implementation of con- 
figuration management policies and procedures. 

Of the 22 findings identified during fiscal year 2008 testing, 21 were repeat find- 
ings, either partially or in whole from the prior year, and one was a new IT finding. 
These findings represent weakness in four of the six key control areas. The areas 
impacted included Application Software Development and Change Controls, Access 
Controls, Service Continuity, and Entity-Wide Security Program Planning and Man- 
agement. The majority of the findings were inherited from the lack of properly de- 
signed, detailed, and consistent guidance over financial system controls. 

Specifically, the findings stem from: (1) Unverified access controls through the 
lack of user access privilege re-certifications, (2) entity-wide security program issues 
involving civilian and contractor background investigation weaknesses, (3) inad- 
equately designed and operating change control policies and procedures, (4) patch 
and configuration management weaknesses within the system, and (5) the lack of 
updated disaster recovery plans which reflect the current environment identified 
through testing. These weaknesses may increase the risk that the confidentiality, 
integrity, and availability of system controls and Coast Guard financial data could 
be exploited thereby compromising the integrity of financial data used by manage- 
ment and reported in the DHS financial statements. 

CBP 

We reported in April 2009 that CBP took corrective action to address prior year 
IT control weaknesses."^ For example, CBP made improvements in how it tracks the 
hiring, termination, and systems access of contracted employees within the Office 
of Information Technology (OIT). However, during fiscal year 2008, identified IT 
general control weaknesses continued to exist at CBP. The most significant weak- 
nesses, from a financial statement audit perspective, related to controls over access 
to programs and data. 

Although improvement was noted in the audit, many of the conditions identified 
at CBP in fiscal year 2007 have not been corrected because CBP still faces chal- 
lenges related to the merging of numerous IT functions, controls, processes, and or- 
ganizational resource shortages. During fiscal year 2008, CBP took steps to address 
these conditions. Despite these improvements, CBP needs further stress on the mon- 
itoring and enforcement of access controls. CBP needs to further emphasize the im- 
portance of developing and implementing well-documented procedures at the system 
and entity-level. 

FEMA 

FEMA took corrective action to address prior year IT control weaknesses. We re- 
ported in March 2009 that FEMA made improvements by restricting access to off- 
line account tables, implementing an alternate processing site for one of its financial 
applications, and improving the process for retaining National Flood Insurance Pro- 


^ Information Technology Management Letter for the United States Coast Guard Component 
of the FY 2008 DHS Financial Statement Audit (OIGr-09^7, March 2009). 

‘^Information Technology Management Letter for the FY 2008 Customs and Border Protection 
Financial Statement Audit (OIG-09— 59, April 2009). 
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gram (NFIP) change control documentation.® However, during fiscal year 2008, IT 
general control weaknesses at FEMA still existed. The most significant weaknesses 
from a financial statement audit perspective related to controls over access to pro- 
grams and data and controls over program changes. 

Of the 26 findings identified during the fiscal year 2008 testing, 15 were repeat 
findings, either partially or in whole from the prior year, and 11 were new findings. 
These findings were representative of five of the six key control areas. Specifically, 
the findings stem from: (1) Inadequately designed and operating access control poli- 
cies and procedures relating to the granting of access to systems and supervisor re- 
certifications of user access privileges, (2) lack of properly monitored audit logs, (3) 
inadequately designed and operating change control policies and procedures, (4) 
patch and configuration management weaknesses within the system, and (5) the 
lack of tested contingency plans. These weaknesses may increase the risk that the 
confidentiality, integrity, and availability of system controls and FEMA financial 
data could be exploited, thereby compromising the integrity of financial data used 
by management and reported in the DHS financial statements. 

FLETC 

We reported in April 2009 that FLETC made minimal progress on its control 
weaknesses.® Therefore, many of the prior year Findings and Recommendations 
(NFR) could not be closed completely due to the reliance on the impending Momen- 
tum application upgrade, the decommissioning of Procurement Desktop and the in- 
stallation of new hardware that would improve the overall IT security structure at 
FLETC. As a result, there was one (1) prior year NFR closed, twenty (27) reissued 
NFRs, and three (3) new NFRs issued to FLETC. 

The IT testing at FLETC disclosed matters involving the internal controls over 
financial reporting and its operation that we consider to be a significant deficiency 
under AICPA standards. Deficiencies in the design and operation of FLETC’s inter- 
nal controls which could adversely affect the agency’s financial statements were 
noted. Deficiencies also existed in entity-wide security planning, access controls, ap- 
plication development and change control, system software, segregation of duties, 
and service continuity that have contributed to the significant deficiency. 

TSA 

In fiscal year 2008, TSA took corrective action to address prior year IT control 
weaknesses. We reported in April 2009 that TSA made improvements in testing dis- 
aster recovery procedures, reviewing audit logs, and implementing emergency re- 
sponse training for all personnel with data center access.'^ However, IT general con- 
trol weaknesses that impact TSA’s financial data remain. The most significant 
weaknesses from a financial statement audit perspective related to controls over the 
termination of the contract with the software support vendor, the design and imple- 
mentation of configuration management policies and procedures, and the develop- 
ment, implementation, and tracking of coding changes to the software maintained 
for TSA by the Coast Guard. 

Of the 15 findings identified during our fiscal year 2008 testing, 13 are repeat 
findings, either partially or in whole from the prior year, and two are new IT find- 
ings. These findings represent weaknesses in four of the six key control areas. Spe- 
cifically, (1) unverified access controls through the lack of comprehensive user access 
privilege re-certifications, (2) entity-wide security program issues involving civilian 
and contractor background investigation weaknesses, (3) inadequately designed and 
operating change control policies and procedures, and (4) the lack of updated dis- 
aster recovery plans which reflect the current environment identified through test- 
ing. These weaknesses may increase the risk that the confidentiality, integrity, and 
availability of system controls and TSA financial data could be exploited thereby 
compromising the integrity of financial data used by management and reported in 
TSA’s financial statements. 

DHS IT DISASTER RECOVERY EFFORTS 

Following a service disruption or a disaster, DHS must be able to recover its IT 
systems quickly and effectively in order to continue essential functions, including fi- 
nancial management support. In May 2005, we reported on deficiencies in the De- 


^ Information Technology Management Letter for the Federal Emergency Management Agency 
Component of the FY 2008 DHS Financial Statement Audit (OIG— 09-48, March 2009). 

^Information Technology Management Letter for the Federal Law Enforcement Training Center 
FY 2008 Financial Statement Audit (OIG— 09-63, April 2009). 

"^Information Technology Management Letter for the Transportation Security Administration 
FY 2008 Financial Statement Audit (OIG— 09-62, April 2009). 
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partment of Homeland Security’s disaster recovery planning for information sys- 
tems.® We recommended that the Department allocate the funds needed to imple- 
ment an enterprise-wide disaster recovery program for mission critical systems, re- 
quire that disaster recovery capabilities be included in the implementation of new 
systems, and ensure that disaster recovery-related documentation for mission crit- 
ical systems be completed and conform to current Government standards. 

We conducted a follow-up audit last year and reported in April 2009 that the De- 
partment has made progress in establishing an enterprise-wide disaster recovery 
program.® Specifically, the Department has allocated funds for this program since 
fiscal year 2005, and by August 2008 had established two new data centers. Fur- 
ther, the Department now includes contingency planning as part of the system au- 
thorization process and it has issued guidance to ensure that contingency planning 
documentation conforms to Government standards. 

While the Department has strengthened its disaster recovery planning, more work 
is needed. For example, the two new data centers need interconnecting circuits and 
redundant hardware to establish an active-active processing capability. 

We noted that not all critical Departmental information systems have an alter- 
nate processing site. Further, disaster recovery guidance does not conform fully to 
Government standards. Finally, risk assessments of the data centers are outdated. 

In our fiscal year 2008 report, we recommended that the Chief Information Officer 
implement the necessary circuits and redundant resources at the new data centers; 
ensure that critical Departmental information systems have complete contingency 
planning documentation; and conform Departmental contingency planning guidance 
to Government standards. Additionally, the Department should reassess data center 
risks whenever significant changes to the system configuration have been made. 

The fiscal year 2008 financial statement audit noted that service continuity issues 
continue to impact DHS’ ability to ensure that DHS financial data is available when 
needed, including instances where the Continuity of Operations Plan (COOP) does 
not include an accurate listing of critical information technology systems, did not 
have critical data files and an alternate processing facility documented, and was not 
adequately tested, and various weaknesses identified in alternate processing sites. 
Service continuity is one of the main IT general control areas that continue to 
present a risk to financial systems data integrity for DHS’ financial systems. 

Among recommendations for service continuity for DHS’ financial systems were 
to update the COOP to document and prioritize an accurate listing of critical IT sys- 
tems, ensure that alternate processing sites are made operational, and test backups 
at least quarterly. 

TRANSFORMATION AND SYSTEMS CONSOLIDATION (TASC) 

DHS has recognized that it needs to improve its financial management processes, 
as well as the systems that support those processes. Toward that end, DHS is mov- 
ing ahead with TASC, an enterprise-wide initiative, aimed at modernizing, trans- 
forming, and integrating the financial, acquisition, and asset management capabili- 
ties of DHS components. According to DHS, TASC is not an update of legacy sys- 
tems, but an implementation of integrated financial, asset, and procurement man- 
agement capabilities that will subsume many systems and standardize business 
processes. The resulting system, once implemented, is aimed at providing a real- 
time (providing immediate viewing of data), web-based system (accessed from any- 
where) of integrated business processes that will be used by component financial 
managers, service providers, program managers, and auditors to make sound busi- 
ness decisions to support the DHS mission. 

The goals and objectives of the TASC initiative are numerous and reflect the col- 
lective input from the components. TASC also represents an effort to leverage the 
work done by Office of Federal Financial Management (OFFM) and will achieve full 
compliance with the rigid standards outlined by OFFM. TASC will implement en- 
hanced capabilities to achieve the following goals: 

• Create end-to-end standardized integrated business processes; 

• Support timely financial management; 

• Enable the acquisition of best value goods and services that meet the Depart- 
ment’s quality and timeliness requirements; 

• Enable consolidated asset management across all components; 

• Create a standard central accounting line. 


^Disaster Recovery Planning for DHS Information Systems Needs Improvement (OIG— 05-22, 
May 2005). 

^DHS’ Progress in Disaster Recovery Planning for Information Systems (OIG— 09-60, April 
2009). 
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TASC is DHS’ third attempt to address comprehensively its long-standing finan- 
cial management process and system problems. The first effort, kno^wn as the Elec- 
tronically Managing Enterprise resources for Government Effectiveness and Effi- 
ciency (e-Merge) project, was canceled in December 2005 after DHS had spent $24 
million on what DHS officials had determined to be a failure. The second effort fo- 
cused on moving DHS components to one of two financial systems platforms: SAP 
and Oracle. However, a Federal court ruled in Savantage Financial Services, Inc. 
vs. United States that DHS’ decision to use Oracle and SAP financial software sys- 
tems via “Brand Name Justification” document is improper sole source procurement 
in violation of the Competition in Contracting Act. In response to this decision, 
RMTO revised its financial systems consolidation strategy to the current approach. 

TASC is a high-risk initiative that will take years to complete, potentially costing 
over $1 billion. We are presently completing a review of DHS’ efforts in planning 
and implementing TASC, and plan to report on the results of our review in a few 
months. 

In summary, the DHS CFO and CIO in conjunction with the component CFOs 
and CIOs are responsible for working together to standardize DHS’ core financial 
systems. However, weaknesses in financial management processes and IT security 
controls over these systems continue to hinder the Department’s ability to effectively 
produce accurate consolidated financial information. DHS is currently in the proc- 
esses of developing and implementing a new financial system solution that will mod- 
ernize, transform, and integrate financial, acquisition, and asset management infor- 
mation for DHS components. Once DHS addresses the current issues in financial 
processing and IT security controls and successfully develops and implements a new 
financial systems solution, the Department will be able to promote overall efficiency 
and effectiveness in its financial management. 

Mr. Chairman, this concludes my prepared statement. Thank you for this oppor- 
tunity and I welcome any questions from you or Members of the subcommittee. 

Mr. Carney. Okay. Thank you for your testimony. 

I now recognize Ms. Daly to summarize her statement for 5 min- 
utes. 

STATEMENT OF KAY L. DALY, DIRECTOR, FINANCIAL MANAGE- 
MENT AND ASSURANCE ISSUES, GOVERNMENT ACCOUNT- 
ABILITY OFFICE 

Ms. Daly. Mr. Chairman and Ranking Member Bilirakis, thank 
you very much for the opportunity to discuss the Department of 
Homeland Security’s current effort to implement a consolidated De- 
partment-wide financial management system. 

Since DHS began operations in March 2003, it has faced a 
daunting task of trying to bring together 22 diverse agencies and 
developing an integrated financial system. In June 2007 we re- 
ported that the Department had made little progress in integrating 
its existing financial management systems and made six rec- 
ommendations focused on the need for DHS to define a Depart- 
ment-wide strategy and embrace discipline processes to reduce risk. 

In June 2007 DHS officials announced its new financial manage- 
ment systems strategy, called the TASC program. In January 2009 
DHS issued a request for proposal for an integrated commercial off- 
the-shelf software system already in use at a Federal agency. DHS 
is currently evaluating the proposals it has received and expects to 
award a contract in January 2010. 

Today my testimony will focus on our preliminary observations 
related to DHS’s implementation of the six recommendations that 
we made in June 2007 and two issues that have surfaced during 
our recent review that pose challenges to the TASC program. 

Regarding the six recommendations we made in June 2007, our 
preliminary analysis indicates that DHS has begun to take action 
toward implementation of four of the recommendations, but all six 
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remain open. We do recognize that DHS cannot fully implement all 
of our recommendations until a contract is awarded because of its 
selected acquisition approach. 

DHS has taken, but not completed, actions related to the TASC 
strategy and plan, a concept of operations, discipline processes, and 
key human capital practices and plans for such a systems imple- 
mentation. DHS has not taken necessary actions on two remaining 
recommendations to standardize business processes across the De- 
partment and to develop detailed consolidation of migration plans. 

I would like to focus on DHS’s strategy. The strategy being taken 
by DHS does not appropriately consider whether the acquired sys- 
tem will provide the needed functionality. For example, the strat- 
egy does not require DHS to perform a GAAP analysis before the 
system is selected and to assess the extent to which cost-based sys- 
tems used at another agency have been customized. 

Studies have shown that when an effective GAAP analysis is not 
performed, program officers, and contractors have later discovered 
that the selected system lacked essential capabilities. Adding these 
capabilities later during implementation required expensive custom 
development and resulted in cost and schedule overruns that could 
have been avoided. 

While updating the status of the six prior recommendations, we 
also identified two issues that pose unnecessary risk to the success 
of the TASC program. The first issue is DHS’s significant reliance 
on contractors to define and implement the program. The Depart- 
ment plans to have the selected contractor prepare a number of key 
plans needed to carry out discipline processes and define additional 
business processes to be standardized and propose a migration ap- 
proach. 

However, DHS has not developed the necessary contractor over- 
sight mechanism to ensure that a significant reliance on contrac- 
tors for TASC does not result in an unfavorable outcome. Our work 
on other systems acquisition and implementation efforts has shown 
that placing too much reliance on contractors can result in systems 
efforts plagued with serious performance and management prob- 
lems. 

The second issue we identified was that the contractor hired to 
perform verification and validation functions for TASC was not 
independent. DHS management has agreed, and they indicated 
they have restructured the contract to address our concerns. 

In conclusion, Mr. Chairman and the other Members of the sub- 
committee, 6 years after the Department was established, DHS has 
yet to implement the Department-wide integrated financial system. 
The open recommendations from our prior report continue to be 
vital to the success of the TASC program. 

Given the approach DHS has selected, it will be paramount that 
DHS take steps to minimize risk associated with its strategy in 
contractor oversight. Failure to do so could lead to acquiring a sys- 
tem that does not meet cost, schedule, and performance goals. 

So, Mr. Chairman and the other Members of the subcommittee, 
this completes my prepared statement, and I would be glad to re- 
spond to any questions you may have at this time. 

[The statement of Ms. Daly follows:] 



13 


Prepared Statement of Kay L. Daly (with Nabajyoti Barkakati) 
October 29, 2009 

Financial Management Systems: DHS Faces Challenges to Successfully 
Consolidate Its Existing Disparate Systems 

Mr. Chairman and Members of the subcommittee: Thank you for the opportunity 
to discuss the Department of Homeland Security’s (DHS) current effort — the Trans- 
formation and Systems Consolidation (TASC) program — to implement a consolidated 
Department-wide financial management system. Since DHS began operations in 
March 2003, it has faced the daunting task of bringing together 22 diverse agencies 
and developing an integrated financial management system. DHS officials have long 
recognized the need to integrate their financial management systems, which are 
used to account for over $40 billion in annual appropriated funds. The Department’s 
prior effort, known as the Electronically Managing Enterprise Resources for Govern- 
ment Effectiveness and Efficiency (eMerge2) project,'^ was expected to integrate fi- 
nancial management systems Department-wide and address existing financial man- 
agement weaknesses. However, DHS officials terminated the eMerge2 project in De- 
cember 2005, acknowledging that this project had not been successful. In June 2007, 
we reported ^ the Department had made little progress since December 2005 in inte- 
grating its existing financial management systems, and that, from an overall per- 
spective, the decision to halt its eMerge2 project was prudent. We made six rec- 
ommendations focused on the need for DHS to define a Department-wide strategy 
and embrace disciplined processes to reduce risk to acceptable levels.^ 

In June 2007, DHS officials announced its new financial management systems 
strategy, called the TASC program. At that time, the TASC program was described 
as the migration of other DHS component systems to two existing financial manage- 
ment systems already in use at several components. After a bid protest was filed 
regarding the proposed approach, the TASC request for proposal was revised to ac- 
quire an integrated commercial off-the-shelf software (COTS) system to be imple- 
mented Department- wide. In January 2009 DHS issued its TASC request for pro- 
posal for the provision of an integrated financial, acquisition, and asset management 
commercial off-the-shelf software (COTS) system already in use at a Federal agency 
to be implemented Department-wide. DHS is currently evaluating the proposals re- 
ceived and expects to award a contract in January 2010. 

Today, our testimony will focus on our preliminary observations related to our 
audit of: (1) DHS’ implementation of the six recommendations we made in June 
2007, and (2) two issues that have surfaced that pose challenges to the TASC pro- 
gram. We have discussed the preliminary observations included in this testimony 
with DHS officials. To address these objectives, we reviewed the January 2009 re- 
quest for proposal and its attachments, such as the Statement of Objectives and So- 
lution Process Overview, to understand DHS’ plans for implementing the TASC pro- 
gram. We also reviewed other available planning documents, such as the Acquisition 
Plan and the draft concept of operations, and determined the status of these plans 
and others to see if DHS had fully implemented our recommendations. We inter- 
viewed key officials from DHS’ Office of the Chief Financial Officer and its Resource 
Management Transformation Office (RMTO), including its Director and Deputy Di- 
rector for elaboration and to provide additional perspectives to the information con- 
tained in these documents. We also reviewed the Statement of Work for an inde- 
pendent verification and validation (IV&V) contractor and confirmed key informa- 
tion about this contract with the Director of RMTO. 

We recently provided our draft report, including recommendations, on the results 
of our audit to the Secretary of Homeland Security for review and comment. We 
plan to incorporate DHS’ comments as appropriate and issue our final report as a 
follow-up to this testimony. We conducted this performance audit from March 
through October 2009 in accordance with generally accepted Government auditing 
standards. Those standards require that we plan and perform the audit to obtain 
sufficient, appropriate evidence to provide a reasonable basis for our findings and 


^The eMerge2 project was expected to establish the strategic direction for migration, mod- 
ernization, and integration of DHS’ financial, accounting, procurement, personnel, asset manage- 
ment, and travel systems, processes, and policies. 

2 GAO, Homeland Security: Departmentwide Integrated Financial Management Systems Re- 
main a Challenge, GAO— 07-536 (Washington, DC: June 21, 2007); and GAO, Homeland Secu- 
rity: Transforming Department-wide Financial Management Systems Remains a Challenge, 
GAO-07-1041T (Washington, DC: June 28, 2007). 

3 The use of the term “acceptable levels” acknowledges the fact that any systems acquisition 
has risks and can suffer the adverse consequences associated with defects. 
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conclusions based on our audit objectives. We believe that the evidence obtained pro- 
vides a reasonable basis for our findings and conclusions based on our audit objec- 
tives. 


BACKGROUND 

Bid protests and related litigation have resulted in changes to DHS’ approach for 
the TASC program and have contributed to a significant delay in awarding a con- 
tract. The initial TASC approach was to migrate its component systems to two fi- 
nancial management systems — Oracle Federal Financials and SAP — that were al- 
ready in use by several DHS components.^ Figure 1 shows the key events that have 
occurred affecting the TASC program. One of these key events was the filing of a 
hid protest regarding DHS’ initial TASC approach to migrate its components to two 
financial management systems already in use. DHS subsequently issued its January 
2009 TASC request for proposal for the provision of an integrated financial, acquisi- 
tion, and asset management COTS system already in use at a Federal agency to 
he implemented Department-wide. A second bid protest was filed over this January 
2009 request for proposal and the U.S. Court of Federal Claims dismissed the 
protestor’s complaint, allowing DHS to proceed with this request for proposal. How- 
ever, the protestor filed an appeal of this dismissal in July 2009. DHS responded 
to the July 2009 appeal in September 2009 and DHS officials indicated that the 
protestor responded to DHS’ response in October 2009. 


Flgiro 1: Koy EvonU Aff«cting th» TASC Program 
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DHS issued a request for propose lor maitaging the migratjon of OHS' five drfferent irtartoal n’lanagenvent 
software solutions to a shared system besehne (Orade or SAP systems). 
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DHS canceled the request tor proposal because no offerors had submitted proposals. 
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DHS issued a new. revised request for proposal with the same purpose as the 8f07 proposal. 
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A finarvda) services company, who ttas a potential offeror to DHS' 2007 request for proposal, filed a bid protest 
with the U.S. Court of Federi^ OaimsT 
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The Court enjomed DHS from proceeding with the November 2007 request for proposal until DHS conducted a 
‘competitive procuremenl.* in accordance with ihe law.° 
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9/08 

DHS issued a notice cortoeming a new request for proposal to be issued shortly. 

■ 

10/08 

DHS issued a draft ol a new request for proposal for public comment. 
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11/08 

The original protestor filed a motion with the Court to enforce the March 2008 injunction.* 
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1/09 

DHS issued a new TASC request for proposal for prosrision of *an iniegraled financial management, asset 
management and acquisition managenvent systems solulion and performance of TASC support services."* 
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The original protestor filed a new bid protest with the Court, alleging that DHS violated the March 2008 injunction 
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by proceeding with the January 2009 request for proposal. 
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The Court dismissed the bid protestors compfaint, which sMowed DHS to proceed with its TASC request for 
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The original protestor filed an appeal of Ihe Court's April 2009 judgment. 
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DHS' response to the July 2009 appeal. 
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The protestor's response to OHS' September 2009 response. 
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The offeror alleged that DHS had conducted an imprc^er aole acurce procurement. 


^Oracle Federal Financials was already in use within the U.S. Coast Guard, the Transpor- 
tation Security Administration, and the Domestic Nuclear Detection Office. SAP was already in 
use within the U.S. Customs and Border Protection. 
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‘Under 28 U.S.C. § 1 491 (b), the U.S. Court of Federal Claima haa juriadictbn to render Judgments 
and award relief to an interastad party objecting to a request for propoeal issued by federal agencies. 

The U.S. Court of Federal Claims issued an order enjoining DHSfrcm proceeding with this 
procurement until DHS conducted a competitive procurement, in accordance with the Competition in 
Contracting Act (41 U.S.C. § 253), which generally requires executive agencies to procure property 
and services through the use of competitive procedures that allow for full and open competiticn. 

^he potential offeror filed a motbn with the U.S. Court of Federal Claims alleging that DHS had 
violated the Court’s March 2008 injunction against proceeding with the original request for proposal. 

*Un like the first two T ASC request for proposals, this request was issued to the pubib in arrtbipatbn 
of a new contract. The first two rsquests for proposals we re issued only to awardees of existing 
indefinite delrvery, indefinite quantity contracts with the expectation of awarding a task order under 
one of the existing contracts. 

DHS HAS MADE LIMITED PROGRESS IN IMPLEMENTING OUR PRIOR RECOMMENDATIONS 

In June 2007, we made six recommendations® to DHS to help the Department 
reduce the risks associated with acquiring and implementing a Department-wide fi- 
nancial management system. Our preliminary analysis indicates that DHS has 
begun to take actions toward the implementation of four of the recommendations, 
as shown in table 1. However, all six recommendations remain open. We do recog- 
nize that DHS cannot fully implement all of our recommendations until a contract 
is awarded because of its selected acquisition approach. 

TABLE 1.— DHS’ PROGRESS TOWARD ADDRESSING GAO’S 
RECOMMENDATIONS 


Not Completed 


Recommendation 


Completed Some 
Actions 
Taken 


No Action 
Taken 


Clearly define and document a Department-wide • 

financial management strategy and plan to 
move forward with its financial management 
system integration efforts. 

Develop a comprehensive concept of operations • 

document. 

Utilize and implement these specific disciplined • 

processes to minimize project risk: (1) Re- 
quirements management, (2) testing, (3) data 
conversion and system interfaces, (4) risk 
management, (5) configuration management, 

(6) project management, and (7) quality assur- 
ance. 

Reengineer business processes and standardize • 

them across the department, including appli- 
cable internal control. 

Develop a detailed plan for migrating and con- • 

solidating various DHS components to an in- 
ternal shared services approach if this ap- 
proach is sustained. 

Carefully consider key human capital practices • 

as DHS moves forward with its financial man- 
agement transformation efforts so that the 
right people with the right skills are in place 
at the right time. 

Source: GAO analysis of DHS information. 

DHS Faces Significant Challenges To Implement Its Financial Management Strategy 
and Plan 

DHS has developed certain elements for its financial management strategy and 

plan for moving forward with its financial system integration efforts but it faces sig- 


sGAO-07-536. 
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nificant challenges in completing and implementing its strategy. DHS has defined 
its vision for the TASC program, which is to consolidate and integrate Department- 
wide mission-essential financial, acquisition, and asset management systems, by 
providing a seamless, real-time, web-based system to execute mission-critical end- 
to-end integrated business processes. DHS has also established several major pro- 
gram goals for TASC which include, but are not limited to: 

• creating and refining end-to-end standard business processes and a standard 
line of accounting; 

• supporting timely, complete, and accurate financial management and reporting; 

• enabling DHS to acquire goods and services of the best value that ensure that 
the Department’s mission and program goals are met; and, 

• enabling consolidated asset management across all components. 

DHS officials stated that this system acquisition is expected to take a COTS-based 
system already configured and being used at a Federal agency as a starting point 
for its efforts. This approach is different than other financial management system 
implementation efforts reviewed by GAO where an agency acquired a COTS product 
and then performed the actions necessary to configure the product to meet the agen- 
cy’s specific requirements.® 

Our review found that the strategy being taken by DHS does not contain the ele- 
ments needed to evaluate whether the acquired system will provide the needed 
functionality or meet users’ needs. For example, it does not require DHS to: (1) Per- 
form an analysis of the current processes to define the user requirements to be con- 
sidered when evaluating the various systems, (2) perform a gap analysis before the 
system is selected® and (3) assess the extent to which the COTS-based system used 
at another agency has been customized for the respective Federal entities. Studies 
have shown that when an effective gap analysis was not performed, program offices, 
and contractors later discovered that the selected system lacked essential capabili- 
ties. Furthermore, adding these capabilities required expensive custom development, 
and resulted in cost and schedule overruns that could have been avoided. ® Without 
a comprehensive strategy and plan that considers these issues, DHS risks imple- 
menting a financial management system that will be unnecessarily costly to main- 
tain. 

DHS Has Recently Developed a Concept of Operations for the TASC Program 

The January 2009 request for proposal states that the selected contractor will be 
required to provide a concept of operations for TASC. This concept of operations is 
expected to provide an operational view of the new system from the end users’ per- 
spective and outline the business processes as well as the functional and technical 
architecture for their proposed systems. On October 21, 2009, DHS provided us with 
a concept of operations for the TASC program that we have not had the opportunity 
to fully evaluate to assess whether it comprehensively describes the new system’s 
operations and characteristics. According to DHS officials, this concept of operations 
document was prepared in accordance with the Institute of Electrical and Elec- 
tronics Engineers (IEEE) standards.^® However, it is unclear how the DHS-prepared 
concept of operations document will relate to the selected contractor’s concept of op- 
erations document called for in the request for proposal. 

According to the IEEE standards, a concept of operations is a user-oriented docu- 
ment that describes the characteristics of a proposed system from the users’ view- 
point. A concept of operations document also describes the operations that must be 
performed, who must perform them, and where and how the operations will be car- 
ried out. The concept of operations for TASC should, among other things: 

• define how DHS’ day-to-day financial management operations are and will be 
carried out to meet mission needs; 

• clarify which component and Department-wide systems are considered financial 
management systems; 


®GAO, Business Modernization: Improvements Needed in Management of NASA's Integrated 
Financial Management Program, GAO— 03— 507 (Washington, DC: April 30, 2003); and GAO, 
DOD Business Systems Modernization: Navy ERP Adherence to Best Business Practices Critical 
to Avoid Past Failures, GAO-05— 858 (Washington, DC: Sept. 29, 2005). 

^A gap analysis is an evaluation performed to identify the gaps between needs and system 
capabilities. 

® Software Engineering Institute, Rules of Thumb for the Use of COTS Products, CMU/SEI— 
2002-TR-032 (Pittsburgh, PA: December 2002). 

®U.S. Department of Defense, Commercial Item Acquisition: Considerations and Lessons 
Learned (Washington, DC: June 26, 2000). 

^^lEEE Guide for Information Technology — System Definition — Concept of Operations 
(ConOps) Document, Standard 1362-1998. 
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• include a transition strategy that is useful for developing an understanding of 
how and when changes will occur; 

• develop an approach for obtaining reliable information on the costs of its finan- 
cial management systems investments; and: 

• link DHS’ concept of operations for the TASC program to its enterprise architec- 
ture. 

A completed concept of operations prior to issuance of the request for proposal 
would have benefited the vendors in developing their proposals so that they could 
identify and propose systems that more closely align with DHS’ vision and specific 
needs. 

DHS Has Not Fully Incorporated Disciplined Processes into the TASC Program 

While DHS has draft risk management, project management, and configuration 
management plans, DHS officials told us that other key plans relating to disciplined 
processes generally considered to be best practices will not be completed until after 
the TASC contract is awarded. These other plans include the requirements manage- 
ment,ii data conversion and system interfaces, quality assurance, and testing 
plans. Offerors were instructed in the latest request for proposal to describe their 
testing, risk management, and quality assurance approaches as well as component 
migration and training approaches. The approaches proposed by the selected con- 
tractor will become the basis for the preparation of these plans. While we recognize 
that the actual development and implementation of these plans cannot be completed 
until the TASC contractor and system have been selected, it will be critical for DHS 
to ensure that these plans are completed and effectively implemented prior to mov- 
ing forward with the implementation of the new system. 

Disciplined processes represent best practices in systems development and imple- 
mentation efforts that have been shown to reduce the risks associated with software 
development and acquisition efforts to acceptable levels and are fundamental to suc- 
cessful system implementations. The key to having a disciplined system develop- 
ment effort is to have disciplined processes in multiple areas, including project plan- 
ning and management, requirements management, configuration management, risk 
management, quality assurance, and testing. Effective processes should be imple- 
mented in each of these areas throughout the project life cycle because change is 
constant. Effectively implementing the disciplined processes necessary to reduce 
project risks to acceptable levels is hard to achieve because a project must effec- 
tively implement several best practices, and inadequate implementation of any one 
may significantly reduce or even eliminate the positive benefits of the others. 

DHS Has Not Yet Identified All Business Processes Needing Reengineering and 
Standardization Across the Department 

Although, DHS has identified nine end-to-end business processes that will be 
addressed as part of the TASC program, the Department has not yet identified all 
of its existing business processes that will be reengineered and standardized as part 
of the TASC program. It is important for DHS to identify all of its business proc- 
esses so that the Department can analyze the offerors’ proposed systems to assess 
how closely each of these systems aligns with DHS’ business processes. Such an 
analysis would position DHS to determine whether a proposed system would work 
well in its future environment or whether the Department should consider modi- 
fying its business processes. Without this analysis, DHS will find it challenging to 
assess the difficulties of implementing the selected system to meet DHS’ unique 
needs. 

For the nine processes identified, DHS has not yet begun the process of re- 
engineering and standardizing those processes. DHS has asked offerors to describe 
their proposed approaches for the standardization of these nine processes to be in- 
cluded in the TASC system. According to an attachment to the TASC request for 
proposal, there will be additional unique business processes or sub-processes, be- 


According to the Software Engineering Institute, requirements management is a process 
that establishes a common understanding between the customer and the software project man- 
ager regarding the customer’s business needs that will be addressed by a project. A critical part 
of this process is to ensure that the requirements development portion of the effort documents, 
at a sufficient level of detail, the problems that need to be solved and the objectives that need 
to be achieved. 

Data conversion is defined as the modification of existing data to enable it to operate with 
similar functional capability in a different environment. 

12 Testing is the process of executing a program with the intent of finding errors. 

I’l These nine processes are Request to Procure, Procure to Pay, Acquire to Dispose, Bill to 
Collect, Record to Report, Budget Formulation to Execution, Grants Management, Business In- 
telligence Reporting, and Reimbursable Management. 
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yond the nine standard business processes identified, within DHS and its compo- 
nents that also need to be supported by the TASC system. For DHS’ implementation 
of the TASC program, reengineering and standardizing these unique business proc- 
esses and sub-processes will be critical because the Department was created from 
22 agencies with disparate processes. A standardized process that addresses, for ex- 
ample, the procurement processes at the U.S. Coast Guard, Federal Emergency 
Management Agency (FEMA), and the Secret Service, as well as the other DHS 
components, is essential when implementing the TASC system and will be useful 
for training and the portability of staff. 

DHS Has Not Yet Developed Plans for Migrating the New System to its DHS Compo- 
nents 

Although DHS officials have stated that they plan to migrate the new system first 
to its smaller components and have recently provided a high-level potential ap- 
proach it might use, DHS has not outlined a conceptual approach or plan for accom- 
plishing this goal throughout the Department. Instead, DHS has requested that 
TASC offerors describe their migration approaches for each of the Department’s 
components. 

While the actual migration approach will depend on the selected system and 
events that occur during the TASC program implementation, critical activities in- 
clude: (1) Developing specific criteria requiring component agencies to migrate to the 
new system rather than attempting to maintain legacy business; (2) defining and 
instilling new values, norms, and behaviors within component agencies that support 
new ways of doing work and overcoming resistance to change; (3) building consensus 
among customers and stakeholders on specific changes designed to better meet their 
needs; and (4) planning, testing, and implementing all aspects of the migration of 
the new system. For example, a critical part of a migration plan for the new system 
would describe how DHS will ensure that the data currently in legacy systems is 
fully prepared to be migrated to the new system. 

An important element of a migration plan is the prioritizing of the conversion of 
the old systems to the new systems. For example, a FEMA official stated that the 
component has not replaced its outdated financial management system because it 
is waiting for the implementation of the TASC program. However, in the interim, 
FEMA’s auditors are repeatedly reporting weaknesses in its financial systems and 
reporting, an important factor to be considered by DHS when preparing its migra- 
tion plan. Because of the known weaknesses at DHS components, it will important 
for DHS to prioritize its migration of components to the new system and address 
known weaknesses prior to migration where possible. Absent a comprehensive mi- 
gration strategy, components within DHS may seek other financial management 
systems to address their existing weaknesses. This could result in additional dis- 
parate financial management systems instead of the integrated financial manage- 
ment system that DHS needs. 

DHS Has Begun Hiring, But Has Not Developed a Human Capital Plan for the 
TASC Program 

While DHS’ RMTO has begun recruiting and hiring employees and contractors to 
help with the TASC program, the Department has not identified the gaps in needed 
skills for the acquisition and implementation of the new system. DHS officials have 
said that the Department is unable to determine the adequate staff levels necessary 
for the full implementation of the TASC program because the integrated system is 
not yet known; however, as of May 2009, the Department had budgeted 72 full-time 
equivalents (FTE) for fiscal year 2010. The 72 FTEs include 38 Government em- 
ployees and 34 contract employees, (excluding an IV&V contractor). DHS officials 
told us that this level of FTEs may be sufficient for the first deployments of the 
new system. 

According to RMTO officials, as of August 2009, RMTO had 21 full-time Federal 
employees with expertise in project management, financial business processes, 
change management, acquisition management, business intelligence, accounting 
services, and systems engineering. In addition, RMTO officials stated that there are 
seven contract workers supporting various aspects of the TASC program. RMTO 
also utilizes the services of the Office of the Chief Financial Officer and component 
staff. According to RMTO officials, some of DHS’ larger components, such as Immi- 
gration and Customs Enforcement have dedicated staff to work on the TASC pro- 
gram. 


According to 0MB guidance, an FTE or work year generally includes 260 compensable days 
or 2,080 hours. These hours include straight-time hours only and exclude overtime and holiday 
hours. 
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Many of the Department’s past and current difficulties in financial management 
and reporting can be attributed to the original stand-up of a large, new, and com- 
plex Executive branch agency without adequate organizational expertise in financial 
management and accounting. Having sufficient human resources with the requisite 
training and experience to successfully implement a financial management system 
is a critical success factor for the TASC program. 

PLANNED TASC IMPLEMENTATION EFFORTS POSE UNNECESSARY RISKS 

While updating the status of the six prior recommendations, we identified two 
issues that pose unnecessary risks to the success of the TASC program. These risks 
are DHS’ significant reliance on contractors to define and implement the new sys- 
tem and the lack of independence of DHS’ V&V function for the TASC program. 

Significant Reliance Placed on Contractors to Define and Implement the TASC Pro- 
gram 

The Department plans to have the selected contractor prepare a number of key 
documents including plans needed to carry out disciplined processes, define addi- 
tional business processes to be standardized, and propose a migration approach. 
However, DHS has not developed the necessary contractor oversight mechanisms to 
ensure that its significant reliance on contractors for the TASC program does not 
result in an unfavorable outcome. 

Work with other systems acquisition and implementation efforts have shown that 
placing too much reliance on contractors can result in systems efforts plagued with 
serious performance and management problems. For example, DHS’ Office of In- 
spector General (OIG) recently reported that the U.S. Customs and Border Protec- 
tion (CBP) had not established adequate controls and effective oversight of contract 
workers responsible for providing Secure Border Initiative (SBI) program support 
services. Given the Department’s aggressive SBI program schedule and shortages of 
program managers and acquisition specialists, CBP relied on contractors to fill the 
staffing needs and get the program underway. However, CBP had not clearly distin- 
guished between roles and responsibilities that were appropriate for contractors and 
those that must be performed by Government employees. CBP also had not provided 
an adequate number of contracting officer’s technical representatives (COTR) to 
oversee support services contractors’ performance. As a result, according to the OIG 
report, contractors were performing functions that should have been performed by 
Government workers. According to the OIG, this heavy reliance on contractors in- 
creased the risk of CBP relinquishing its responsibilities for SBI program decisions 
to support contractors, while remaining responsible and accountable for program 
outcomes. 

Verification and Validation (V&V) Review Function for the TASC Program Wos Not 
Independent 

DHS’ V&V contractor was not an independent reviewer because RMTO was re- 
sponsible for overseeing the contractor’s work and authorizing payment of the V&V 
invoices. On October 21, 2009, DHS officials indicated that they have restructured 
the V&V contract to address our concerns by changing the reporting relationship 
and the organization that is responsible for managing the V&V contract. Under the 
previous arrangement, the V&V contractor was reporting on work of the RMTO, the 
program manager for the TASC program and the RMTO Director was serving as 
the COTR for the V&V contract. As part of the COTR’s responsibilities, RMTO 
approved the V&V contractor’s invoices for pa 3 mient. The independence of the V&V 
contractor is a key component to a reliable verification and validation function. 

Use of the V&V function is a recognized best practice for large and complex sys- 
tem development and acquisition projects, such as the TASC program. The purpose 


Institute of Electrical and Electronics Engineers Standard 1012-2004 — Standard for Soft- 
ware Verification and Validation (June 8, 2005) states that the verification and validation proc- 
esses for projects are used to determine whether: (1) The products of a given activity conform 
to the requirements of that activity and (2) the software satisfies its intended use and user 
needs. This determination may include analyzing, evaluating, reviewing, inspecting, assessing, 
and testing software products and processes. The verification and validation processes should 
assess the software in the context of the system, including the operational environment, hard- 
ware, interfacing software, operators, and users. 

Department of Homeland Security, Office of Inspector General, Better Oversight Needed of 
Support Services Contractors in Secure Border Initiative Programs, OIG— 09-80 (Washington, 
DC: June 17, 2009). 

COTRs are responsible for monitoring the contractor’s progress in fulfilling the technical re- 
quirements specified in the contract. COTRs often approve invoices submitted by contractors for 
payment. 
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of the V&V function is to provide management with objective insight into the pro- 
gram’s processes and associated work products. For example, the V&V contractor 
would review system strategy documents that provide the foundation for the system 
development and operations. According to industry best practices, the V&V activity 
should be independent of the project and report directly to senior management to 
provide added assurance that reported results on the project’s status are unbiased, 
An effective V&V review process should provide an objective assessment to DHS 
management of the overall status of the project, including a discussion of any exist- 
ing or potential revisions to the project with respect to cost, schedule, and perform- 
ance. The V&V reports should identify to senior management the issues or weak- 
nesses that increase the risks associated with the project or portfolio so that they 
can be promptly addressed. DHS management has correctly recognized the impor- 
tance of such a function and advised us that they have taken prompt steps so that 
the V&V function is now being overseen by officials in DHS’ Office of the Chief In- 
formation Officer. It is important that V&V is technically, managerially, and finan- 
cially independent of the organization in charge of the system development and/or 
acquisition it is assessing. 

In conclusion, Mr. Chairman, 6 years after the Department was established, DHS 
has yet to implement a Department-wide, integrated financial management system. 
DHS has started, but not completed implementation of the six recommendations we 
made in June 2007, aimed at helping the Department to reduce risk to acceptable 
levels, while acquiring and implementing an integrated Department-wide financial 
management system. The open recommendations from our prior report continue to 
be vital to the success of the TASC program. In addition, as DHS moves toward ac- 
quiring and implementing a Department-wide financial management system, it has 
selected a path whereby it is relying heavily on contractors to define and implement 
the TASC program. Therefore, adequate DHS oversight of key elements of the sys- 
tem acquisition and implementation will be critical to reducing risk. Given the ap- 
proach that DHS has selected, it will be paramount that DHS develop oversight 
mechanisms to minimize risks associated with contractor-developed documents such 
as the migration plans, and plans associated with a disciplined development effort 
including requirements management plans, quality assurance plans, and testing 
plans. DHS faces a monumental challenge in consolidating and modernizing its fi- 
nancial management systems. Failure to minimize the risks associated with this 
challenge could lead to acquiring a system that does not meet cost, schedule, and 
performance goals. 

To that end, our draft report includes specific recommendations, including a num- 
ber of actions that, if effectively implemented, should mitigate the risks associated 
with DHS’ heavy reliance on contractors for acquiring and implementing an inte- 
grated Department-wide financial management system. In addition, we also rec- 
ommended that DHS designate a COTR for the IV&V contractor that is not in 
RMTO, but at a higher level of Departmental management, in order to achieve the 
independence needed for the V&V function. As discussed earlier, DHS officials ad- 
vised us that they have already taken steps to address this recommendation and 
we look forward to DHS expeditiously addressing our other recommendations too. 

Mr. Chairman, this completes our prepared statement. We would be happy to re- 
spond to any questions you or other Members of the subcommittee may have at this 
time. 

Mr. Carney. Thank you, Ms. Daly. 

I now recognize Ms. Sherry for 5 minutes. 

STATEMENT OF PEGGY SHERRY, ACTING CHIEF FINANCIAL 
OFFICER, DEPARTMENT OF HOMELAND SECURITY 

Ms. Sherry. Thank you. Again, I would like to apologize again 
to the committee for getting my testimony in late. Thank you for 
your indulgence in that. 

Thank you. Chairman Carney, Ranking Member Bilirakis and 
Members of the committee, for the opportunity to testify before you 
on the Department of Homeland Security’s progress and plans to 
create One DHS by standardizing financial management. 


To provide this objective evidence, V&V contractors analyze, evaluate, review, inspect, as- 
sess, and test software products and processes. 
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The DHS mission is to lead a unified National effort to secure 
America. This requires a unified Department and an integrated ap- 
proach across our various operations, including financial manage- 
ment. As you know, one of the Secretary’s top priorities is to unify 
the Department and to create a common culture: One DHS, one en- 
terprise, a shared vision with integrated results-based operations. 

We have many initiatives under way to continue to build a One 
DHS culture, including our commitment to strengthening internal 
controls and realigning business processes for improved efficiency 
and effectiveness. 

To this end I would like to thank the Congress for enacting the 
Department of Homeland Security’s Financial Accountability Act. 
With the passage of the act, we launched an ambitious multi-year 
effort to improve financial management and reporting and to build 
assurances that internal controls are in place and working effec- 
tively. 

The foundation for One DHS strategy is to bring together the 
varying perspectives of DHS components to build a consolidated 
best practice approach to financial management. As an example, 
DHS financial reporting working groups were established recently 
to uniformly address financial management and business process 
challenges. 

Financial managers from the components work together to iden- 
tify common areas of weakness, such as accounting for property, 
plant, and equipment or undelivered orders. Instead of components 
developing individual action plans to address areas of common 
weaknesses across the Department, they now work together to find 
the best solutions that can be used by all the components. 

We continue to implement initiatives aimed at increasing finan- 
cial management competencies. This past fall we released a DHS 
Financial Management Policy Manual. This on-line manual pro- 
vides Department-wide guidance on budget formulation, execution, 
financial management, accounting, and reporting, and introduces 
standardization throughout DHS with a focus on strong internal 
controls. 

We issued the third edition of the Internal Control Playbook, 
which outlines our strategy and processes to eliminate internal con- 
trol weaknesses and to build management assurances. 

To further unify DHS financial management practices, we are 
adopting a Department-wide standard accounting classification 
structure. A common accounting line will improve our ability to 
capture and report financial information in a consistent and timely 
manner across the Department. 

DHS received a disclaimer of opinion in its fiscal year 2008 fi- 
nancial statement. However, for the third consecutive year, audit 
results show we continue to make steadfast progress. Auditors 
noted the Department’s progress in implementing corrective actions 
and improving the quality and reliability of our reporting. 

Our multi-year corrective action plan led to reducing the number 
of material weaknesses from 10 to seven to six in the past 3 years. 
We also reduced the number of disclaimer conditions from 10 to six 
to three in the past 3 years. Audit challenges remain, but in more 
focused areas. 
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This year we have partnered with the United States Coast 
Guard, Transportation Security Administration, and the Federal 
Emergency Management Agency to address audit disclaimer and 
material weaknesses conditions. As they make improvements on 
our financial reporting and strengthen the skills of our workforce, 
we continue to move forward to consolidate our financial system, 
bringing forward lessons learned from our previous effort. 

Currently, DHS has 13 separate financial management systems. 
These systems support different business processes, numerous ac- 
counting lines, and have varying levels of systems integration, with 
many still relying on manual processes. This often results in incon- 
sistent and inaccurate financial data. 

DHS’s ability to efficiently and effectively manage and oversee 
our day-to-day operations and programs relies heavily on our abil- 
ity to have financial management systems that produce complete, 
reliable, timely, and consistent financial information for use by 
DHS managers and leaders. 

Although modernization is complex, it is a critical element of in- 
stituting strong financial management as called for by the CFO 
Act, SFMIA, the Financial Accountability Act, and other financial 
management reform legislation. As we work to address our finan- 
cial management challenges in increased transparency and report- 
ing, the Transformation and Systems Consolidation, or TASC ini- 
tiative, it is critical. 

The Department will acquire an integrated system solution that’s 
already operating in the Federal space. We are in the midst of the 
TASC acquisition and are on track to select a vendor by second 
quarter fiscal year 2010. This important initiative will enhance 
mission support and improve our ability to report financial data in 
a timely and accurate way. 

Financial management has come a long way at DHS, and I am 
inspired by the extraordinary efforts of our dedicated staff at head- 
quarters and in the components to becoming One DHS. I am com- 
mitted to pursuing financial management success in the Depart- 
ment. As we continue our progress to building One DHS, I look for- 
ward to working with the GAO and the IG. Our relationship will 
be able to help us improve our efforts to build a consolidated and 
integrated Department. 

I appreciate the support we have received from our IG, from the 
GAO, this committee and Congress. Thank you for your leadership 
and your continued support of the Department of Homeland Secu- 
rity. 

[The statement of Ms. Sherry follows:] 

Prepared Statement of Peggy Sherry 
October 29, 2009 

Thank you Chairman Carney, Ranking Member Bilirakis, and Members of the 
committee for the opportunity to testify before you on the Department of Homeland 
Security’s (DHS) progress and plans to create One DHS by standardizing financial 
management. 

DHS leads a unified National effort to secure America — this requires a unified De- 
partment and an integrated approach across our varying operations. The Secretary 
continues to prioritize unif3dng the Department and creating a common culture: One 
enterprise, a shared vision, with integrated results-based operations. In March, Sec- 
retary Napolitano launched a Department-wide efficiency review to trim costs. 
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streamline operations, eliminate duplication, and better manage resources across 
the Department. This effort includes more than two dozen initiatives that will in- 
crease efficiency, leverage economies of scale, create a culture of responsibility and 
fiscal discipline, and save taxpayers millions of dollars. 

We have many initiatives underway to continue to build one DHS culture, includ- 
ing our commitment to strengthening internal controls and realigning business proc- 
esses for improved efficiencies and effectiveness. To this end, I would like to thank 
Congress for enacting the Department of Homeland Security’s Financial Account- 
ability Act. With the passage of the act, we launched an ambitious multi-year effort 
to improve financial management and reporting and build assurances that internal 
controls are in place and working effectively. We have worked to standardize busi- 
ness practices as well as executed systematic plans to correct weaknesses. I look for- 
ward to continuing to work collaboratively with Congress, the Government Account- 
ability Office, the DHS Office of the Inspector General, the Office of Management 
and Budget, and our independent auditor to further strengthen internal controls 
and improve and standardize financial management practices across the Depart- 
ment. 


STRATEGIES FOE STANDARDIZING FINANCIAL MANAGEMENT 

The financial management community is emplo 3 dng multiple strategies to bring 
together the varying perspectives of DHS components to build a consolidated best- 
practice approach to financial management at DHS. 

As an example, DHS financial reporting working groups were established to uni- 
formly address financial management and business process challenges. Financial 
managers meet regularly to identify common areas of weakness and develop strate- 
gies usable by all components. This approach allows components to share success 
strategies with other components struggling in the same area. We also created a 
“Component Requirements Guide” that contains approximately 40 standard finan- 
cial reporting processes. Implementing standard processes across the components 
has resulted in providing ample, reliable, timely data and meeting financial state- 
ment submission deadlines. 

Last fall, we published the first-ever DHS Financial Management Policy Manual, 
which provides a standard set of financial management policies with a focus on 
strong internal controls. This manual, developed with input from all DHS compo- 
nents, is an on-line repository of Department-wide guidance for program and budget 
formulation, budget execution, financial management, accounting, and financial re- 
porting. 

To further unify DHS financial management practices, we are adopting a Depart- 
ment-wide standard accounting classification structure. To do this, we are defining 
the standard fields for the DHS accounting line using the Common Government- 
wide Accounting Classification (CGAC) structure issued by the Financial Systems 
Integration Office in cooperation with the Office of Management and Budget (0MB). 
A common accounting line will allow DHS to capture and report financial informa- 
tion in a consistent and timely manner across the Department. Staff from across 
DHS financial, budget, acquisition, asset management, and program management 
communities are working together to implement the new standard. 

DHS has more than 230,000 employees, and we have more than 2,000 in the fi- 
nancial management community dispersed throughout the United States. In order 
to help bridge our geographic separation, my office hosts a training session for all 
new employees in the DHS financial management community. This program wel- 
comes new employees into DHS, provides a comprehensive introduction to financial 
management at DHS, and trains employees on a common set of core competencies, 
including the responsibilities of all financial managers to support and reinforce 
strong internal controls and the principles of fiscal law. It also provides an oppor- 
tunity for staff in different components to meet, share ideas, and form a valuable 
network with other financial management professionals at DHS. Over the past 2 
years, we have hosted five of these events with over 450 employees attending, near- 
ly 30 percent of whom were from outside the Washington, DC area. 

STRENGTHENING INTERNAL CONTROLS TO STANDARDIZE AND IMPROVE FINANCIAL 

MANAGEMENT 

DHS has been working diligently to correct its financial weaknesses. When DHS 
was first stood up, there were an estimated 100 financial management systems 
across the 22 components. Further, we inherited 30 significant financial reporting 
deficiencies, with 18 classified as material weaknesses. These conditions hampered 
the Department’s ability to produce timely, reliable financial data in support of a 
clean audit. Over the last several years, however, the annual financial statement 
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audits have shown continued improvement toward consistent and accurate financial 
reporting. 

We have institutionalized a strong strategy, updated annually in our Internal 
Control Playbook, across DHS to address the remaining weaknesses. For each finan- 
cial management weakness, we: Identify the root cause(s); desi^ strong, actionable 
plans to address the weakness; and then track our progress against those plans. My 
office leads the efforts, and I work closely with component CFOs to oversee and 
monitor progress throughout the year. Our independent auditors report that the De- 
partment continues to make good progress implementing corrective actions and im- 
proving the quality and reliability of our financial reporting. Consider the following 
accomplishments that offer validation that our strategy is working: 

• DHS reduced the number of material weaknesses from 10 in fiscal year 2006, 
to seven in fiscal year 2007, to six in fiscal year 2008. 

• The Secretary’s Financial Reporting Assurance Statement has improved from a 
statement of no assurance in fiscal year 2005 to a statement that good internal 
controls are in place in fiscal year 2008. For fiscal year 2009, the Department’s 
goal is to provide our first-ever assurance that internal controls are working, 
with only a few exceptions. 

• The Department is on target to have five favorable opinions on audits of indi- 
vidual component balance sheets in fiscal year 2009, and the goal is to have iso- 
lated the adverse conditions that prevent completion of an audit area to one 
component which has detailed multi-year plans to remedy these conditions. 

Our remaining audit challenges are now contained to a few specific areas. We con- 
tinue to partner with and provide oversight of the U.S. Coast Guard, Transportation 
Security Administration, and Federal Emergency Management Agency to address 
the remaining audit disclaimer and material weakness conditions. This joint effort 
has produced significant improvements; for example, I expect the number of mate- 
rial weaknesses at FEMA to be reduced for the second consecutive year. 

Key to the Department’s continued progress toward good financial management 
is the ability of the components to produce consistent, reliable financial data. An in- 
tegrated, enterprise-wide financial acquisition and asset management system will 
make it easier to implement and maintain stronger internal controls and to ensure 
consistent, accurate, and reliable financial information across DHS. 

FINANCIAL SYSTEMS CONSOLIDATION 

DHS is moving forward with a financial system consolidation effort. This will 
greatly improve the quality of and control over DHS financial data, make the finan- 
cial accounting process more efficient throughout DHS, and reinforce standard busi- 
ness and financial management practices. Currently, DHS has 13 separate financial 
management systems. While we have made significant progress standardizing var- 
ious aspects of financial management in DHS, the 13 systems support different busi- 
ness processes, numerous accounting lines, and have varying levels of system inte- 
gration — with many still relying on manual processes. This often results in incon- 
sistent and inaccurate financial data. Further, maintaining multiple systems across 
the Department means duplicative operations and maintenance costs, and high 
overhead when upgrades, support services, and system changes are necessary. 

As we work to address our financial management challenges and increase trans- 
parency, consistency, and accuracy, the Transformation and System Consolidation 
(TASC) initiative is critical. The Department will acquire a proven, integrated sys- 
tem solution that meets Federally defined financial business processes require- 
ments, as issued by the Financial Systems Integration Office in cooperation with 
0MB. We are in the midst of the TASC acquisition and will select a vendor by the 
second quarter of fiscal year 2010. We have also developed a strong program man- 
agement office to provide full-time, day-to-day oversight of the integration process 
to help ensure success. This important initiative will enhance mission support and 
improve our ability to report financial data in a timely and accurate way. 

LESSONS LEARNED FROM PREVIOUS EFFORTS 

In September 2006, the Department ended the Electronically Managing Enter- 
prise Resources for Government Effectiveness and Efficiency (eMerge2) systems ini- 
tiative since it failed to build the necessary integration between the various com- 
mercial off-the-shelf software solutions. The effort was budgeted at $252 million but 
was halted after $52 million was spent on the project. 

We have learned from eMerge2 and have applied those lessons to the TASC initia- 
tive. Rather than building a new system from scratch, as was the eMerge2 strategy, 
DHS is acquiring an existing, already integrated Federal system that follows estab- 
lished standard Federal financial business processes with defined key internal con- 
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trol requirements. Putting in place an integrated system with standard processes 
will allow us to produce data that is consistent and incorporates strong internal con- 
trols to ensure financial transactions are properly processed, verified, and accurately 
recorded. In addition, TASC will take a phased approach to implementation rather 
than having the entire Department go live at once. 

Another key lesson learned from eMerge2 is the importance of having adequate 
Federal staffing and strong oversight of contractor performance. To this end, we 
have put in place a robust team of full-time Federal employees with expertise in 
project management, systems accounting, change management, acquisition manage- 
ment, business intelligence, accounting services, and systems engineering. We also 
have an on-site Independent Verification and Validation team in place to monitor 
and evaluate every aspect of the program as we move forward. 

CONCLUSION 

We have demonstrated our commitment to developing and executing strong, ac- 
tionable plans that improve our financial management with strong internal controls. 
Consolidating our financial, asset, and acquisition systems will accelerate and sus- 
tain Department-wide progress in our efforts for efficiency, effectiveness, trans- 
parency, and accountability. As DHS undertakes its transformation and system con- 
solidation effort, the Department’s financial management infrastructure will become 
more stable and will significantly contribute to achieving the intended goals of the 
DHS Financial Accountability Act. 

Financial management has come a long way at DHS. I continue to be inspired 
by the extraordinary efforts of our dedicated staff both at headquarters and in the 
components, and I am committed to pursuing financial management success. I ap- 
preciate the support that we have received from our Office of Inspector General, the 
GAO, this committee, and Congress. Thank you for your leadership and your contin- 
ued support of the Department of Homeland Security. I would be happy to answer 
any questions you may have. 

Mr. Carney. Thanks, Ms. Sherry. 

I want to thank each of the witnesses for their testimony. 

I remind each Member that he or she will have 5 minutes to 
question the panel. I now recognize myself for 5 minutes. 

Ms. Daly, let us begin with you. The news we heard is not good. 
It seems like it might be improving, but we are 6 years down the 
line now, over 6 years, and we are at a place where accountability, 
you know, is trying to be the watchword of the day, especially ac- 
countability for taxpayers’ dollars, and we are having a tough time 
with that at DHS. 

From your opinion, you know, is the news improving? What 
needs to be done that hasn’t been done yet? What sort of time 
frame are we looking at for improvement, I mean for doing things 
in a standardized way that we have transparency and account- 
ability of taxpayers’ dollars? 

Ms. Daly. Mr. Chairman, I think DHS faces a monumental task 
in pulling together the information needed. I am not familiar with 
the time frames that they have in place, but I can assure you from 
our review of the TASC program that we have certain concerns 
with the strategy they are taking related to TASC and not doing 
a detailed, structured GAAP analysis of the proposed system to 
what they want their future business processes to be. Without tak- 
ing that particular step, I think they are increasing their risk re- 
lated to that program. 

Mr. Carney. Mr. Taylor, how do you respond to that? 

Mr. Taylor. Well, sir, we haven’t completed our report on TASC 
itself However, in viewing the prior attempts of the Department 
to try to have an integrated financial system, it included a lack of 
identified requirements, clear requirements. It included a lack of 
adequate oversight capabilities, the trained contractor specialists 
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we talked about, and it included, as is mentioned by the committee, 
the over-reliance on contractors. 

If those three things still exist, then the Department is truly in 
a high-risk environment for being able to implement anything suc- 
cessfully. 

Mr. Carney. Are we on track to fix that, Ms. Sherry? 

Ms. Sherry. Thank you, sir, and yes. I appreciate the comments 
from both the GAO as well as the IG and do know that the Depart- 
ment is absolutely committed to working with you and to making 
sure that the recommendations are fully implemented. 

I do believe that we are on track, sir, to be able to address some 
of these recommendations. I look forward to working with them as 
they further develop their report. 

We did learn quite a bit from the initial eMerge effort. The initial 
eMerge initiative basically failed on the idea that we were devel- 
oping the system. What we were doing was gathering thousands 
and thousands of requirements, and ultimately the submission 
failed on its inability to be able to integrate everything. 

That is not the strategy the Department is implementing cur- 
rently. Instead, what we are doing is we are acquiring a solution 
that is 

Mr. Carney. No, I think it was unplugged. She is doing some- 
thing down front here. 

Thank you. 

Mr. Taylor, the Department decided that it was going to use a 
commercial off-the-shelf, or COTS, system to do this. Is that a good 
idea? 

Mr. Taylor. That is usually required by 0MB. I have been in- 
volved with this in the past, and when you do your own develop- 
ment, you add a level of risk that most agencies are going to find 
unacceptable. 

Mr. Carney. So that was not a good idea, then. 

Mr. Taylor. To use COTS is a good idea. 

Mr. Carney. Yes, it is. 

Mr. Taylor. It is. I am sorry, sir. Yes, it is. To do your own de- 
velopment, to do a custom software development is a bad idea, be- 
cause then you are introducing a higher level of risk. The COTS 
has been tested in the Federal environment, and there are a num- 
ber of vendors out there who can provide it and that there was suc- 
cess, and there is usually an implementation you can look at and 
learn from in terms of best practice. 

Mr. Carney. Okay. Well, kind of along those lines, what agencies 
use integrated systems that can serve as a model for the Depart- 
ment’s efforts? I mean, you know, we got a big Government out 
there. There are probably some cases we could have that we could 
point to which are the best. 

Mr. Taylor. Sure, absolutely. Yes, sir. Most agencies have been 
through the kind of agony, I guess, that the Department of Home- 
land Security is going through now. 

In my experience at the Department of Commerce, we went 
through this between 1997 and 2003, implementing from a decen- 
tralized approach to a centralized system. The Department of 
Transportation has been through the same thing. I believe Agri- 
culture has been through it. There are a number of agencies that 
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have gone through this that had, and there are a number of best 
practices. 

There also are vendors out there in the Federal sphere or other 
departments and agencies who provide these services, so instead of 
having to do your own implementation, you can purchase the sup- 
port from those organizations instead of having to do this for your- 
self 

Mr. Carney. Okay. I think we have a problem with the timers 
here. I imagine my time is about up. I will recognize the Ranking 
Member from Florida, Mr. Bilirakis, for 5 minutes, and I guess I 
will be the official timekeeper here with my 12-year-old Swiss 
Army watch. 

Mr. Bilirakis. I won’t take the 5 minutes. 

Mr. Carney. There you go. 

Mr. Bilirakis. Ms. Sherry, much was said about the importance 
of leadership from the top to the success of the financial consolida- 
tion efforts. Have the Secretary and deputy secretary been briefed 
on TASC, the TASC initiative? Are they supportive of the current 
plan? 

Ms. Sherry. Yes, sir, thank you very much. Yes, we have had 
the opportunity. I have had the opportunity to brief the Secretary 
and the deputy secretary on not just the TASC initiative, but also 
on the state of financial management at DHS. They understand the 
criticality of having of having a system solution in order to be able 
to move the Department forward. 

Mr. Bilirakis. So they are supportive. 

Ms. Sherry. It is in line and in keeping with the One DHS ini- 
tiative that is so important to the Secretary. 

Mr. Bilirakis. Okay. What impact has the lack of a permanent 
under secretary for management and a permanent CFO had on the 
Department’s ability to implement TASC? 

Ms. Sherry. Other than just making me really busy, it really 
has not had much of an impact, sir. The under secretary for man- 
agement has been very engaged, and I think, as you may or may 
not be aware, we actually have a deputy under secretary for man- 
agement as well, so they have been very engaged as well as very 
supportive with us. 

When I go back to my full-time job, or my regular job — I am the 
deputy CFO also — and this is clearly a very important initiative, 
and one that I will be primarily responsible for sure, sir. 

Mr. Bilirakis. Okay. How, if at all, has the Department’s finan- 
cial management oversight and consolidation efforts changed under 
the new administration? 

Ms. Sherry. I don’t really think that we have had a chance, sir. 
I think that management — you know, having strong management 
with the Secretary having been a former Governor, I think that she 
is a very strong executive leader, and I think that she really under- 
stands and completely supports either the objectives and goals of 
my offices, you know, to continue to standardize processes through- 
out the Department and to really make financial management, 
good financial management, just basic, you know, part of every 
day, you know, what it is that we do, rather than something that 
we have to continually come up and, you know, explain the reason 
why we are not doing very well. She is very supportive of it. 



28 


Mr. Bilirakis. Can you explain why TASC will cost so much 
more than eMerge2? 

Ms. Sherry. I am sorry, sir. Can — why TASC would cost 

Mr. Bilirakis. Why it would cost so much more than eMerge2? 

Ms. Sherry. I can’t really speak to the total cost of what 
eMerge2 was, sir. I know that the Department had spent about $52 
million before they actually stopped the initiative, so I can take 
that for the record and possibly get back to you on that. 

Mr. Bilirakis. What controls do you have in place to make sure 
the contract doesn’t — there are no overruns? 

Ms. Sherry. There are several things that we have got in place 
currently, and I completely agree with both the GAO as well as the 
IG to be able to say strong contractor oversight is paramount. It 
will be paramount to the success of this initiative, and I do believe 
that that may have been one of the failings also of eMerge was the 
inability of the Department to necessarily be able to, you know, 
make sure I have that oversight over the contractors. 

My office in particular has been staffing up very heavily to have 
a very strong project management office. We have worked with the 
other large acquisition efforts within the Department to be able to 
really have lessons learned from them, to find out how we should 
structure our PMO office. 

We talked a little bit about some of the other departments that 
have initiatives under way. We have done heavy outreach with 
them to find out exactly what they — not only what the lessons 
learned from the standpoint of what they have done well, but also 
in particular what they haven’t done well, so that we can try to 
avoid those mistakes as well. 

The other thing that we have within the Department which is 
different, I think, than when the eMerge2 initiative was begun, is 
a stronger oversight throughout DHS for large acquisition projects. 

We have the Management Directive 102, which really governs 
the acquisition review process, where you have discipline processes, 
including a — a con ops, as Ms. Daly referred to. 

You have required documents that, you know, that the project 
must be able to have completed, get reviewed, and to have been ac- 
cepted through the different keys throughout the Department, as 
well as through the deputy secretary and in the acquisition commu- 
nity within DHS, as well as having a systems engineering lifecycle 
documentation and process that was really intended to review the 
acquisition at every step of the process. 

So in other words, and before you are able to go to a next par- 
ticular gate, you have to go before the deputy secretary and all the 
people that I just mentioned and to be able to demonstrate why 
you are ready to do that. 

Mr. Bilirakis. Okay. Thank you very much. 

I hope I was under 5 minutes, Mr. Chairman. 

Mr. Carney. Exactly 5 minutes, according to my watch. 

The Chairman now recognizes my good friend from New Jersey, 
Mr. Pascrell, for 5 minutes. 

Mr. Pascrell. Mr. Chairman, let me start by saying this, that 
if we do not address the bureaucratic questions at Homeland Secu- 
rity by the next go-round, I want to commit to you, Mr. Chairman, 
that I will not vote for one dime for the Department. I want to 
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make it very clear right now, and I want to agree with your open- 
ing remarks about we have heard a lot of this before. It is kind of 
redundant. We need a re-do here. 

I don’t think we need so much financial consolidation as consoli- 
dation with a capital C. This is a bureaucracy that has become 
cumbersome. 

I am sorry, Mr. Taylor, we cannot make comparison to other de- 
partments, because this Department that we are talking about 
today has the responsibility, as you better than I know, to secure 
the homeland. This is a different — you are comparing apples and 
oranges, and I really want us to focus in on the very nature and 
uniqueness of this Department. 

The demands that we place on Homeland Security are unproduc- 
tive. I can remember Secretary Chertoff sitting out there, telling 
us, enumerating how many committees his folks have to answer 
questions for. It is ridiculous. We haven’t changed anything about 
that. We are wasting your time most of the time, when we fail to 
see our main objective in securing the homeland. 

How many committees do you have to answer to, Mr. Taylor? 
You are still counting, I am sure. 

Mr. Taylor. Yes, sir, we are counting on our fingers and toes 
right now. Ninety-one. 

Mr. Pascrell. Ninety-one committees. Now, 91 committees. Your 
request for the budget was $55 billion — correct me if I am wrong — 
$55-plus billion. 

Mr. Taylor. I will defer to Ms. Sherry on that. 

Mr. Pascrell. Is that correct? 

Ms. Sherry. Yes, sir. The net number is $42.8 billion. 

Mr. Pascrell. Yes, we have a very serious problem here. This 
is not going to go away with one committee hearing, but I want to 
commend you for zeroing in on it and not accepting. We don’t even 
know the percentage of procurements in the last administration — 
how many were bid. We don’t even know that. 

So, Mr. Chairman, I want to thank you for calling the hearing. 
I really hope that people understand the importance of this topic. 
Clearly, if we get a hearing on terror threats or vulnerabilities to 
attack, we would probably get more attention from the media in 
public and the public. 

But I want to be clear when I say this. One of the greatest 
threats to the Nation’s security is the bureaucracy itself We are 
fighting an enemy that is not State-based. They don’t have a large 
bureaucratic infrastructure of multi-layered control. Their greatest 
asset is the ability to operate in relative silence and to change di- 
rection quickly in order to attack our vulnerabilities. A bloated 
Homeland Security bureaucracy is one, I believe, of our biggest 
vulnerabilities. 

After the attacks of September 11, 2001, Members of the Con- 
gress from both sides of the aisle pushed the Bush administration 
to create this Department. I certainly think that was the right deci- 
sion, but if all we have done is to throw over 100 Federal entities 
together and call it a day, well, then I believe we have made our 
Nation less safe and not more safe. 

The whole point of creating a Department of Homeland Security 
was not only to increase coordination, which I think we may be get- 
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ting better at, but also to streamline the process by which a threat 
reported in the field can quickly and effectively get to higher com- 
mand to take action. This is what they should be all about. 

I am not convinced that we have cut down on these layers from 
top to bottom. I am not convinced at all. Few things make this 
point more clear than the fact that 6 V 2 years after its creation, the 
Department of Homeland Security has yet to implement a Depart- 
ment-wide integrated financial management system — 6 V 2 years 
later. 

If we can’t even keep track of all the billions of dollars in tax- 
payers’ funds, then how can we find the excess, how can we find 
the ways, how can we possibly get rid of the bloat in the democ- 
racy? How can we defend the republic? 

I have a couple of more questions. I will come back after — my 
time is up? 

Mr. Carney. Very good. I don’t want this to turn into a colloquy, 
but I think Mr. Pascrell is exactly right. If this was about a specific 
threat to the homeland, CNN would be here, and we would have 
a lot more coverage. But this is actually what Government does. 
This is the nuts and bolts stuff that no one pays attention to, but 
is absolutely as important to protecting the homeland as anything 
else that we do, so we can’t underestimate the importance of get- 
ting this right. 

So, you Imow, we have often heard that when in the private sec- 
tor you would take organizations of the size that comprise now 
DHS and put them together, it would be a 5- to 7-year transition 
to get them into one sort of unit. We are at the 61 / 2 -year mark now, 
and we sure see the seams and the fissures that exist. 

We got to do better, and we got to it thoughtfully, but holy cow, 
folks, you know, this is getting to a point where we need to start 
asking the tough questions about are we secure, more secure, than 
we have been? I think we probably are, but we have got to solidify. 
We have got to have the foundations in place. 

So to that end, you know, hearings like this occur and questions 
like these are asked. You know, folks like Mr. Bilirakis and Mr. 
Pascrell and I come and, you know, we want to make it better for 
everyone. 

Ms. Sherry, according to the GAO’s most recent audit, the De- 
partment has taken very limited action toward implementation of 
four of its recommendations and since, you know, they made those 
recommendations in June 2007, about a year-and-a-half ago, it has 
taken no action on the remaining two. Can you tell me why? 

Ms. Sherry. Yes, sir. Part of the reason is because we have not 
selected a solution. What the Department has done is we have 
taken to heart all of the recommendations and have implemented 
those that we can, sir, and we will continue to work with the GAO 
as well as the IG to make sure that we fully implement all of the 
recommendations at the time that we have selected the actual solu- 
tion. 

So, for instance, one of the recommendations was to develop a 
con ops, a concept of operations, and we have done that. It is in 
accordance with the IEEE standard within, you know, the recog- 
nized standards, and what we will do is it is based on all the infor- 
mation that we know currently without actually knowing the ac- 
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tual solution. What we will do is we will work to update all of them 
once we have actually awarded the contract. 

Mr. Carney. Once again, can I ask a time frame question? 

Ms. Sherry. Absolutely, sir. We are on target currently to be 
able to award the contract in second quarter of 2010. 

Mr. Carney. Second quarter of 2010. 

Ms. Sherry. Yes, sir. 

Mr. Carney. Okay. So we will certainly see you back here rough- 
ly in that time frame and 

Ms. Sherry. I look forward to it. 

Mr. Carney [continuing]. Get more accountability there. 

Mr. Bilirakis, any questions? 

Mr. Bilirakis. Thank you, Mr. Chairman. 

Ms. Daly, your written testimony expresses concern about the 
Department’s reliance — I know you touched on this — on contractors 
for the implementation of TASC and notes that the Department 
has not developed necessary contract oversight mechanisms. I 
would have hoped that the Department would have learned from 
its problems with SBI. 

My question is what actions would you recommend that the De- 
partment take to enhance contract oversight? 

Ms. Daly. I think the Department could take a number of steps 
that are based in what the Software Engineering Institute has rec- 
ommended for these types of software implementations. There are 
a number of tasks that they have planned to do in the future, but 
that have not been formalized yet. A lot of these are very impor- 
tant. I think what we have seen at other agencies is that if these 
steps are not taken, what can happen is the cost and schedule over- 
runs that none of us want to occur. 

One of the key examples I can give you are things such as having 
a good testing plan in place. What you often see on a system that 
gets rolled out is that the people that are for the Government are 
relying on the contractors to develop a good testing plan, and the 
Government officials need to understand what are the right testing 
steps to take so that a good comprehensive test is done that identi- 
fies all the defects so those defects can be addressed before they are 
ruled out. Those are the types of mechanisms we think would be 
important for the Department to have in place. 

Mr. Bilirakis. Can you comment on that, Ms. Sherry? 

Ms. Sherry. Yes, sir. Thank you. We are in complete agreement 
with that. I think that we have learned quite a bit since the 
eMerge initiative, and we are in complete agreement that we really 
do need to have strong contractor oversight. 

You know, referring to some of the systems engineering lifecycle 
steps, we are absolutely going to make sure that we incorporate all 
of them. We will be working with the contractor on the testing 
plans. We are not going to hand over simply to the contractor to 
be able to do the work for us. 

It is somewhat different than the SBInet initiative. Again, abso- 
lutely we have learned from the things that we did not do right in 
that initiative. But this is not a development effort, you know, that 
what the Department is doing is we are acquiring an already inte- 
grated, proven system that is working currently in the Federal 
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space, you know. So we will know a lot about the system, and we 
will not actually be developing the system. 

But we are absolutely committed to being able to use all of those 
discipline processes, such as making sure that you have a strong 
testing plan, working with our science and technology group that 
has lots of expertise in this particular area, and also as we come 
before our acquisition review board, having to prove to them before 
we are able to go on to next step that we in fact do have solid test 
plans. 

Mr. Bilirakis. Thank you. 

Mr. Taylor, the inspector general has done considerable work in 
the area of Department financial management. In your opinion 
does the Department have sufficient personnel in both the financial 
offices and the procurement offices to provide sufficient oversight 
over the systems migration in the contract without any over reli- 
ance on contractors? That is my question. 

Mr. Taylor. Without speaking directly to TASC, because we are 
working on that right now, based on the work we have done pre- 
viously, we have a lot of concern about that, concerns because the 
component organizations have skills deficiencies in both procure- 
ment as well as financial management. So to layer a very com- 
prehensive integration effort on top of that would be posing even 
more risk. So we are very concerned about that, sir. 

Mr. Bilirakis. Thank you very much. Appreciate it. 

I yield back, Mr. Chairman. 

Mr. Carney. Thank you. 

The Chair now recognizes Mr. Green for 5 minutes. 

Mr. Green. Thank you, Mr. Chairman. I thank you for — and you, 
the Ranking Member, as well — for hosting this important meeting. 

I am honored to have an opportunity to speak to the witnesses, 
and I thank you for being here today. 

My concerns probably have been addressed, and I apologize, be- 
cause we have a Financial Services hearing that is taking place, 
and we have Mr. Geithner, and we have a host of others, and we 
are obviously having to deal with some of the great issues of our 
time. But this does not in any way excuse me from the issues that 
we have to contend with at Homeland Security. They, too, are 
among the great issues of our time. 

I am concerned about the means by which we can do some of the 
small things. For example, we had the TWIG card issued, but we 
did not have a card reader. It seems to me that that was something 
that did not necessitate a real study to know that if you are going 
to have the card and the reader, it would probably be prudent — 
judicious, if you will — to have both the card and the reader pre- 
sented, make a debut, be put to use at the same time. 

Last time I checked, we still didn’t have a reader that would 
work with the cards and we are still exploring the possibility of ac- 
quiring a reader for cards that we have issued. 

I remember when we had the former Secretary here, whom I do 
not in any way intend to demean, but I do remember commitments 
being made about the cards and the readers, and we never actually 
got that done. So little things like that leave an indelible memory 
such that it becomes difficult to get a grip on how we can do some 
of these very complicated things if we don’t do these little things. 
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So let me ask, for fear that I may have missed something, have 
we deployed the reader for the TWIG cards? 

Ms. Sherry. I can find out for you, sir. I apologize. I don’t know 
that right off the top of my head. I will find out and get back to 
you. 

Mr. Green. Does the representative from GAO know? 

Ms. Daly. Congressman Green, I am sorry. I am not aware of 
the status of that. 

Mr. Green. Okay. All right. That is one example. 

Let us move to another one: P28. I had the good fortune to be 
here while we had much said about P28. Most of what was said 
by way of witnesses was good in the sense that P28 was supposed 
to provide us with a model, a prototype that was to at some point 
be replicated such that we would have this system that allowed us 
to have a merging of various security devices as well as something 
as simple as a fence such that we would be able to monitor our bor- 
der effectively. 

The P28 didn’t quite work out at build after we were billed a lot 
of money. We spent a lot on P28, and it is a little bit disappointing 
for us not to get the product that we paid for. Taxpayers are de- 
manding people, and when we spend their money, they would like 
to see the results that are promised. 

I am not going to ask you to give me an update on P28. I am 
merely mentioning these things such that I can provide you exam- 
ples of how we clearly can do better with better management, bet- 
ter oversight. 

It is my hope — excuse me — it is my hope, my sincere desire that 
we find a means by which we can have GAO, which plays an im- 
portant role in this process — GAO provide us with some of the acid 
tests that we ultimately will have to confront at the genesis of 
these operations, as opposed to what appears, from my perch, to be 
an understanding that manifests itself after we get into revela- 
tions. 

Revelation is a bad time to know what is expected of you. You 
ought to know what is expected of you somewhere at genesis or 
shortly thereafter, so that you can perform and maybe you will get 
some sort of heavenly blessing as a result of good performance. 

Unfortunately, we don’t get, it seems to me, the marriage be- 
tween what GAO is going to monitor and what the contractors are 
going to do by way of performance. We don’t get that early enough 
in the process. So my hope is that we will get that done. 

Mr. Chairman, I am 17 seconds over. I thank you, and I yield 
back the balance of my time. 

Mr. Carney. Thank you, Mr. Green. 

Mr. Pascrell, for 5 minutes. 

Mr. Pascrell. Thank you, Mr. Chairman. 

Most of the bipartisan 9/11 Commission recommendations have 
been addressed sooner or later in the past couple of years except 
for one glaring oversight. That is what we are talking about today: 
The bureaucracy in Homeland Security has not been addressed. 

I would suggest, Mr. Chairman, that the leadership of both par- 
ties must be confronted on this particular issue. I just gave one ex- 
ample before about how many committees they have to come before 
and how many divisions and the total lack of coordination, which 
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does not help our intelligence apparatus one iota. So I think they 
need to he confronted. 

Ms. Sherry, I know in your testimony you talked about Secretary 
Napolitano’s efforts towards efficiency and effective financial man- 
agement. Can you talk specifically towards my point and address 
how the new initiatives towards financial management will lend 
themselves to streamlining operations in the Department of Home- 
land Security? 

Ms. Sherry. Yes, sir. Thanks for the question. I am happy to ad- 
dress that. This initiative really does speak to the One DHS issues 
that I think that you are addressing as far as the bureaucracy. I 
think that we recognize that that is something of an issue that can 
potentially hold us back from operating efficiently and effectively. 
That is something, clearly, that Secretary Napolitano is aware of. 

Several of the things that we are going to be able to do in this 
IT initiative that are outside of the actual financial management 
initiatives that we have going on that I have mentioned, such as 
the Financial Management Policy Manual, you know, us having 
working groups where we are trying to come up with collective so- 
lutions to common problems, some of the things that this IT solu- 
tion will do in addition to that will be to standardize business proc- 
esses throughout DHS. 

There are requirements. There are FSIO standards, what are 
called FSIO standards, which is done by 0MB and the GSA with 
input from the various agencies that basically talk about best prac- 
tices on how you do standard business processes throughout the 
Government. 

One of the objectives of the FMLoB initiative of the 0MB is to 
be able to make more standardization in some of those processes 
that you can standardize that the Government, such as paying a 
bill. The idea that you are going to be paying a bill — you really 
shouldn’t be doing it in a bunch of different ways. 

What we currently have at DHS are, you know, the different 
components who pay bills differently, and the reason they have to 
do that is because they maybe have different types of systems. 
Some of them have legacy issues that come along with them. 

They have different integration so that in one instance you have 
full integration, so once you put in a procurement or you put in an 
award contract, it neatly populates your financial system. In other 
components we don’t have that. Well, you know, what you do is you 
actually put something into the procurement system and then you 
rely on a manual transfer over into your financial system. 

So the idea that we can have the integration, which will really 
bring about more of that One DHS and the standardization of the 
processes, and what comes along with that are internal controls, 
the idea that you should have strong key internal controls as out- 
lined in FSIO and as has been validated through our A123 process, 
which is the Federal Government’s equivalent to, like, Sarbanes- 
Oxley, where we go out there, where management goes out there 
and we identify how are we doing business currently, such as pay- 
ing a bill and identifying within each component what should we 
be doing differently, such as having segregation of duties and, you 
know, so that the person who puts in the contract and approves the 
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contract is not the same person who actually ends up paying the 
bill, so that we can minimize the risk of fraud. 

So things of that nature, sir, and IT solution in addition to these 
other initiatives that we have on-going will help bring about stand- 
ardization at the Department. 

Mr. Pascrell. Thank you. 

Mr. Taylor, the GAO has had the management study of Home- 
land Security, made recommendations. A couple of them have not 
been done. We know, and I think you would agree with me, that 
we are not talking about bureaucracy in the Transportation De- 
partment. We are talking about bureaucracy in defending the coun- 
try, which is a heck of a lot more serious, it would seem to me. 

Let me ask you this. Is this Department manageable? 

Mr. Taylor. Sir, I believe it is. 

Mr. Pascrell. You believe it is. 

Mr. Taylor. That is my personal opinion. I don’t have a report 
to show you from the IG’s office that that concludes this is a man- 
ageable office. We have done work on the organization of the De- 
partment, particularly before the second stage review that was con- 
ducted 3 years ago. We concluded there were inefficiencies, some 
of which were addressed in the second stage review. We think the 
Congress addressed some of the concerns when they mandated a 
reorganization of FEMA and the grants program within the De- 
partment. 

Is the Department perfectly constructed in terms of inefficien- 
cies? Absolutely not. But there has been progress since 6 V 2 years 
ago towards making it more manageable. 

Mr. Pascrell. So at this point you would say, and what you 
have seen and what you have done and what your GAO has con- 
cluded, that the Department itself could be organized differently, 
perhaps, which is a problem with results that we have gotten. Or 
would you say that? 

Like, you know, George Kennan used to talk about democracy in 
that sense. It was like a huge dinosaur that needed its tail 
whacked once in a while. I think of dinosaurs when I think of the 
Homeland Security Department, having been in this effort since 
9/12. 

This is in my bone marrow. This is important to protecting our 
neighborhoods. I am not sure that we have created the right Erec- 
tor set. I am not so sure. So I am listening and reading what you 
have to put out every time you do it. 

Thank you, Mr. Chairman. 

Mr. Carney. Thank you, Mr. Pascrell. 

Let us for a moment talk about kind of specific numbers, as long 
as we have the opportunity here. 

Ms. Sherry, how much do you think it is going to cost to actually 
implement TASC? 

Ms. Sherry. Sir, the independent Government cost estimate is at 
$450 million. 

Mr. Carney. Okay. 

Ms. Daly, would you care to comment on that? 

Ms. Daly. Our work has not examined the dollars that are asso- 
ciated with this effort yet, but we plan to look into that more in 
our future work for the committee. 
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Mr. Carney. Mr. Taylor. 

Mr. Taylor. In my testimony, sir, I mentioned $1 billion. That 
was the figure that was provided in testimony 3 weeks ago by the 
under secretary for management. I think that includes — ^being from 
the CFO side originally, it depends on how you measure things. 
You know, is it the core financial system we are talking about? Is 
it everything, including all the components efforts? 

Depending on how you measure this, the under secretary for 
management saying it is a billion-dollar effort, so we are assuming 
it is a billion-dollar effort. 

Mr. Carney. So more than twice what Ms. Sherry thinks the 
price is. 

Mr. Taylor. Depending on how you measure it, yes, sir. 

Mr. Carney. So are you telling me we can’t even come up with 
a consistent definition or consistent measures of what we are try- 
ing to accomplish here? 

Mr. Taylor. I contend that the IG’s office has not been provided 
with an estimate and the definition of what that estimate includes. 

Mr. Carney. Can the IG’s office tell me who is in charge of defin- 
ing what it is we are trying to do here? 

Mr. Taylor. Our understanding is it is CFO. 

Mr. Carney. Ms. Sherry, so we are somewhere between $450 
million and $1 billion to implement that. You know, from my chair 
and from practically everybody in this room, how do you get a delta 
that large? 

Ms. Sherry. Right, sir. What I can do is I can go back see what 
the $1 billion is referring to, but I think Mr. Taylor is exactly right 
as far as the question that I answered, and possibly I didn’t answer 
the question correctly, was the independent Government cost esti- 
mate as it relates to migration and operation and maintenance, 
which is really within the purview of this particular contract. 

Things such as the hardware and the software are not included 
in that number. In addition, we have developed a life cycle cost es- 
timate. Again, we are standing up the data center. It will be done 
in our data center down in Stennis so that the costs that are asso- 
ciated with that data center is not included in this number as well. 

We do have a life cycle cost estimate that we are working on and 
we are going to be sharing with Ms. Daly as well as Mr. Taylor, 
which I believe — and again, without knowing what was in the bil- 
lion, and I promise I will go back and look at that, I would imagine 
would include some of the things that Mr. Taylor talked about, 
which are not in the $450 million that I referred to, sir. 

Mr. Carney. Okay. So the $450 million does not include the 
hardware, the software, the data center or the lifecycle costs. 

Ms. Sherry. It includes the implementation, and it includes op- 
eration and maintenance for the implemented solution. 

Mr. Pascrell. [Inaudible.] 

Mr. Carney. Boy. 

Mr. Taylor, is $450 million a reasonable price for what we are 
getting? 

Mr. Taylor. Well, sir, I am not sure. I am still not sure what 
that includes, and so we would have to look at what exactly is in- 
cluded in that cost estimate, which, of course, we haven’t had a 
chance to review. 
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I will say that what you are experiencing is the problem with 
these kinds of initiatives. 

Mr. Carney. Yes. 

Mr. Taylor. What happens is that the core financial system 
itself is just a small part of the activity and a part of the cost. 

When Mr. Bilirakis asked me about the financial management 
and the components, do they have the kind of resources necessary 
to carry this out, we are concerned because in my personal experi- 
ence the vast majority of the effort isn’t in hooking up a new box 
with new software. 

The vast majority of the effort is involved in changing the busi- 
ness processes at the feeder level, at the component level, so that 
the information coming in makes sense, not so that you are just 
having a really fancy way of computing bad data. 

That is where the costs are. So any estimate of cost needs to in- 
clude all those kinds of activities and the plan has to account for 
the weaknesses that we have identified in our financial statement 
audits in the component organizations where this is going to fall 
on. 

Mr. Carney. So just kind of a back of the envelope figuring here, 
it may be more than $1 billion in this transition. But once again, 
we don’t know, because we can’t define what it is we are trying to 
do. 

Ms. Sherry. But I mean we can define what it is that we are 
trying to do, and I would absolutely agree with Mr. Taylor that the 
change of management piece of it is critical and having that gov- 
ernance structure in place is critical. 

So these are things that are outside of that $450 million that I 
am talking about, because this is stuff that the Federal workforce 
will be responsible for ensuring that we do stay on track so that 
when we are doing the migrations, when we are doing the analysis 
to be able to determine what are our requirements, and we do 
know what our requirements are relative to what the solution is, 
that we make sure that we have got strong oversight of that. 

We have stood up a program management office in my office. It 
has all the different disciplines in it that are required, such as 
change management. You know, we have CPAs, we have project 
managers, we have systems engineers, we have data warehouse 
specialists, business intelligence specialists. So we have got those. 
You know, we have staffed up to be able to have those people with- 
in my office. 

We are working with the larger components to set up their own 
project management offices. To the idea, to the competencies, it will 
be critical for them to be able to have, you know, their ability to 
be able to understand what it is that the contractor is bringing in 
and to be able to have that oversight and to be able to guide the 
actual implementation. 

Mr. Carney. Ms. Sherry, you have signed up for an exceptionally 
difficult job, and I applaud your courage for doing that. We need 
people of goodwill and brains to take on this kind of thing, and I 
really applaud you for that. 

That said, this subcommittee is going to watch very closely where 
we are in the cost for TASC. That is our task to watch the cost of 
TASC, to put it indelicately here. We will come back to this. 
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Mr. Bilirakis. 

Mr. Bilirakis. Thank you, Mr. Chairman. 

Ms. Sherry, the TASC award, which you have plans to be award- 
ed in early 2010, is for an indefinite delivery indefinite quantity 
contract. Did you consider using a firm fixed-price contract, which 
would limit the risk to the Department in the event of cost over- 
runs? If so, why would you ultimately decide on the IDIQ? 

Ms. Sherry. Yes, sir. Thank you very much for the question. I 
appreciate the opportunity to add one other point, which I think I 
have not talked about, and I believe that your question here kind 
of leads into the idea that the Department is absolutely under- 
taking a phased approach here. 

So what we are not doing, what they had done initially with the 
eMerge, where they tried to bring up the entire Department all at 
once with all these, you know, 8,000-plus requirements that they 
had gathered, we are doing this in a very phased approach. So with 
this IDIQ contract, we will allow us to be able to do that, sir, is 
to be able to issue specific task orders so that we can do this within 
phased approach. 

We have done an awful lot of outreach to other agencies to, like 
I said, to learn the things that they have done well, but also things 
that they wish that they could have changed. 

One of the things that we heard is that if you go right out of the 
box with a firm fixed-priced contract, there is a high likelihood, sir, 
that as they get in there and they start really understanding it and 
doing that analysis between what is it that you want versus what 
is it that the solution has and the things that you need to change, 
that basically you end up with a lot of the items that are simply 
out of scope. 

So what you thought that you were getting with your firm fixed 
price, ultimately you end up just getting an awful lot of out of 
scope issues. 

The way that this contract is structured allows us to be able to 
work with the contractor in phased approach starting with maybe 
one of the smaller entities, and we learn. Not only does the con- 
tractor learn, but the agency learns. 

My PMO will be with them every step of the way, and what we 
would do is we will learn. As we build on our knowledge and our 
learning curve and our competencies, it will move us, sir, into the 
ability to be able to do a firm fixed-price contract. So that is within 
the realm of our ability to be able to issue a firm fixed-price task 
order as well, sir. 

Mr. Bilirakis. Customs and Border Protection has been doing 
well on its current platform. Are you concerned that moving them 
onto the new TASC system will impact their performance? 

Mr. Taylor. I think the CBP has clean audit opinions and has 
probably one of the better installations in DHS in terms of finan- 
cial systems. However, they aren’t without their own issues. Mov- 
ing even a large organization like them in a phased approach to a 
centralized system would probably still in the long run be in the 
best interest of that organization. 

That said, depending on how you plan this, how you carry it out, 
there are a lot of risks involved in it, absolutely. 
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Mr. Bilirakis. Also, in your written testimony you note a num- 
ber of IT control weaknesses at the component level. How many of 
these weaknesses will be resolved by the migration to TASC? 

Mr. Taylor. I think it is premature to answer the question, sir, 
to be honest. I mean because some of the findings are redundant, 
by definition if you have three organizations with the same three 
material weaknesses, then you only have the consolidated three, so 
you drop it from that standpoint. 

But what we do is we take the component material weaknesses 
and roll them up into a consolidated, so assuming that the system 
had the proper internal controls and that the internal processing, 
the way that they are identified and the way planned, then they 
would reduce a lot of the material weakness findings we had. 

Mr. Bilirakis. Anyone else want to comment on that? 

Okay. Thank you very much. 

I yield back, Mr. Chairman. 

Mr. Carney. Thank you, Mr. Bilirakis. 

We have time for a few more questions. 

Mr. Pascrell, 5 minutes. 

Mr. Pascrell. Mr. Chairman, I hope you will follow up on the 
two points that we need an immediate reduction of how many com- 
mittees these folks have to report to — I just think it doesn’t make 
any sense — that point, with leadership. We need to do what we 
have been talking about, you know, around the edge about it. 

The other thing is that bureaucracy within the Department 
itself We need to do something about it. To establish, maybe even 
take another look at how our committee system sets up within the 
Homeland Security Committee’s subcommittees, whether we are 
feeding the bureaucracy. 

We started out by wanting to look into the various financial man- 
agement systems throughout Homeland Security. You need people 
in the Department that are hired within the Department, have a 
lot to do about implementing the mission, and your background be- 
fore you come to the Department. 

This is unlike HHS and Transportation and Labor and all of 
those different departments, because we are talking about a para- 
military. We are talking about the security of the Nation. The peo- 
ple we attract to the Department are going to implement these fi- 
nancial mechanisms and systems, but it would seem to me that we 
should spent a lot more time attracting people who have back- 
ground in security, be it in the police, be it in the military, because 
this is the kind of operation that we need to defend the country. 

We are going to debate numbers. We are going to debate words, 
which are most of the time meaningless unless we have results. 
How can we best defend the homeland? It would mean to me that 
the people we hire in the Department should have some back- 
ground, some knowledge of how military or civilian police operate. 

I hope you would take that message back to the Secretary, be- 
cause I have not had any indication so far in the last 6 months that 
that is at the centerpiece of the people we are attracting into the 
Department. 

When I hear all of this stuff, Mr. Chairman, about quotas and 
make sure everybody is represented in the Department — and I put 
my record up against anybody — but if they don’t know anything 
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about security, how in God’s name can they be part of this Depart- 
ment? 

I would like to know who they are hiring, which is just as signifi- 
cant to me as the different financial mechanisms in all of these 
subdivisions of this Department. I don’t want to minimize, but I 
want to prioritize. To me the priority is who is operating. 

So I want to thank these three folks for your service to your 
country. You did a great job of answering the questions, all of you. 

I think dearly of GAO. I really do. You have made a big dif- 
ference in the Congress and how we look at things. 

I hope Ms. Daly and Ms. Sherry take back to the Secretary, who 
I have a great respect for, but we are not playing tiddlywinks here. 
We are not playing in the sandbox. This is serious stuff. I know it 
is serious for you. It is serious for us. Thank you. 

Thank you, Mr. Chairman. 

Mr. Carney. Thank you, Mr. Pascrell. 

We will adjourn momentarily here. We have votes, and I think 
we are at the end of the string as far as the questions go. 

We have seen the theme here. We started to talk about TASC 
and financial management of the Department and moving and mi- 
grating to a different system, but it doesn’t take too many scrapes 
of the trowel to really expose a lot of underlying problems here. 

We are trying to get to an organization that is efficient and agile. 
We have one that is very inefficient and very cumbersome. You 
know, we take a lot on ourselves here in Congress to try to get 
that. Certainly, in this subcommittee we try to do that. I think you 
have been able to determine the passion that many of us have for 
this task at hand. 

But, you know, we need good people focused on the right ques- 
tions, and please, I admonish every one of you, please let common 
sense prevail. Please. 

I want to thank the witnesses for their testimony. I imagine we 
will see you back again before too long. With that, we are ad- 
journed. 

[Whereupon, at 11:20 a.m., the subcommittee was adjourned.] 
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